CVE-2021-34597

Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory...

WordPress Phoenix Media Rename plugin <= 3.4.2 - Arbitrary Media File Renaming vulnerability

Arbitrary Media File Renaming vulnerability discovered by apple502j in WordPress Phoenix Media Rename plugin versions = 3.4.2. Solution Update the WordPress Phoenix Media Rename plugin to the latest available version at least 3.4.4...

Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming

The plugin does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own. PoC As an Author, go to the page to edit one of your own Media ie /wp-admin/post.php?post=1993=edit, whic...

Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming

The plugin does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own. As an Author, go to the page to edit one of your own Media ie /wp-admin/post.php?post=1993&action=edit,...

CVE-2021-34570

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...

CVE-2021-34570

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...

Code injection

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...

CVE-2021-34570 Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...

CVE-2021-34570

Phoenix Contact PLCnext Control devices (versions prior to 2021.0.5 LTS) are affected by CVE-2021-34570. The issue is a DoS caused by specially crafted JSON requests, reducing availability. The NVD/CVSS reports a HIGH impact with network attack vector and low complexity. Remediation in the provid...

Phoenix Contact PLCnext Control Devices 输入验证错误漏洞

Phoenix Contact PLCnext Control Devices is a programmable logic controller for industrial environments from Phoenix Contact, Germany. An input validation error vulnerability exists in Phoenix Contact PLCnext Control Devices prior to version 2021.0.5LTS, which stems from the control device being...

chuckroppphoenixrealtor.com Cross Site Scripting vulnerability OBB-2146365

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

phoenix-futures.org.uk Cross Site Scripting vulnerability OBB-2139599

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CNA legal filings lift the curtain on a Phoenix CryptoLocker ransomware attack

Two months after fully restoring its systems, CNA Financial, the leading US insurance company that was attacked by a group using Phoenix CryptoLocker ransomware, issued a legal notice of an information security incident to the Consumer Protection Bureau in New Hampshire. You may recall that Phoen...

Arbitrary File Read Vulnerability in WORMCMS of Shanghai Yanfeng Information Technology Co.

WORMCMS is open source and free PHP enterprise website development and construction management system. Shanghai Yanfeng Information Technology Co. WORMCMS has an arbitrary file reading vulnerability, which can be exploited by attackers to obtain sensitive information...

Phoenix Contact Classic Automation Worx Software Suite Buffer Overflow Vulnerability

Phoenix Contact Classic Automation is a division of Phoenix Contac Phoenix Contact, a German company that provides surplus parts and Phoenix Contact repair services. A security vulnerability exists in Software Suite 1.87 and prior versions, which stems from a vulnerability that can be exploited b...

File Upload Vulnerability in WORMCMS of Shanghai Yanfeng Information Technology Co.

WORMCMS is open source and free PHP enterprise website development and construction management system. Shanghai Yanfeng Information Technology Co. WORMCMS file upload vulnerability, an attacker can use the vulnerability to obtain control of the server...

CVE-2021-33541

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of...

CVE-2021-33540

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

CVE-2021-33540

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

CVE-2021-33542

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The...