Arbitrary file read vulnerability in Pipeline: Phoenix AutoTest

Pipeline: Phoenix AutoTest 1.3 and earlier implements a Pipeline step ftp to upload files to an FTP server without limiting the source directory. This allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server...

PT-2022-18855 · Jenkins · Jenkins Pipeline: Phoenix Autotest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier Description: The issue allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace...

@phoenix-plugin-registry/hirse.ungit (0.8.3), hirse.ungit (>=0.4.1, <=0.8.3) potentially affected by CVE-2022-25766 via ungit (>=1.1.22, <=1.5.10)

ungit NPM version =1.1.22, =0.4.1, =0.8.3 Source cves: CVE-2022-25766 Source advisory: OSV:GHSA-HF8C-XR89-VFM5...

Malware Posing as Russia DDoS Tool Bites Pro-Ukraine Hackers

Looking to cyber-hassle Russia, Ukrainian sympathizers? Be careful — malware is making the rounds, disguised as a pro-Ukraine cyber-tool that will turn around and bite you instead, researchers are warning. In a Wednesday threat advisory, Cisco Talos described a campaign it’s observed in which a...

CVE-2022-22509

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

CVE-2022-22509

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

Design/Logic Flaw

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

CVE-2022-22509

CVE-2022-22509 affects Phoenix Contact FL SWITCH Series 2xxx (version 3.00). The issue is an incorrect privilege assignment that lets a low-privilege user gain full access to the device configuration, exposing confidentiality, integrity, and availability (all rated high) per CVSS metrics. No expl...

CVE-2022-22509 PHOENIX CONTACT: FL SWITCH 2xxx series incorrect privilege assignment

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

Phoenix Contact FL SWITCH 安全漏洞

The Phoenix Contact FL SWITCH is an industrial grade Ethernet switch from Phoenix Contact, Germany. A security vulnerability exists in the Phoenix Contact FL SWITCH Series that originates from allowing a user with low privileges to enable full access to the device configuration...

PT-2022-15479

Name of the Vulnerable Software and Affected Versions Phoenix Contact FL SWITCH Series 2xxx version 3.00 Description The issue is related to an incorrect privilege assignment, allowing a low-privileged user to gain full access to the device configuration. Recommendations For Phoenix Contact FL...

CVE-2022-22509: Improper Privilege Management

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

shg-phoenix-sg.de Cross Site Scripting vulnerability OBB-2350702

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-22509

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

CVE-2021-34598

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active...

CVE-2021-34598

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active...

CVE-2021-34582

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code XSS through web-based management or the REST API with a manipulated certificate file...

CVE-2021-34582

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code XSS through web-based management or the REST API with a manipulated certificate file...

Design/Logic Flaw

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active...

Code injection

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code XSS through web-based management or the REST API with a manipulated certificate file...