CVE-2017-7935

A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the device's availability by performing multiple initial VPN requests...

CVE-2017-7937

An Improper Authentication issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may be able to gain unauthorized access to the user firewall when RADIUS servers are unreachable...

CVE-2017-7935

CVE-2017-7935 affects Phoenix Contact mGuard firmware versions 8.3.0–8.4.2. The root cause is a Resource Exhaustion issue where an attacker can degrade availability by sending multiple initial VPN requests. Impact is a loss of device availability; no confidentiality/integrity impact stated. Mitig...

CVE-2017-7937

Phoenix Contact mGuard firmware versions 8.3.0–8.4.2 are affected by two vulnerabilities: (1) Resource Exhaustion (CWE-400) enables disruption of device availability through multiple initial VPN requests; (2) Improper Authentication (CWE-287) could allow unauthorized access to the user firewall w...

PHOENIX CONTACT mGuard

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerabilities: Resource Exhaustion, Improper Authentication AFFECTED PRODUCTS The following versions of mGuard, a network device, are affected: mGuard firmware versions 8.3.0 to 8.4....

phoenixgrp.com XSS vulnerability

Vulnerable URL: https://www.phoenixgrp.com/Join/?=joinformssshc=SSSH= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 850770 VIP website status:| No Check phoenixgrp.com SSL...

phoenixcontact.com XSS vulnerability

Vulnerable URL: https://www.phoenixcontact.com/online/portal/de?q=a%3E%27%3E%22%3Et%3Ci%3Ep%3Cimg+src%3Dy+onerror%3Dprompt%28%2Fopenbugbounty%2F%29%3E=pxc-search%3Awebsite=dede Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.09.2017 Vulnerability type:| XSS...

phoenixperennials.com XSS vulnerability

Vulnerable URL: http://www.phoenixperennials.com/nursery/listresults.php?query=%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 10:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

phoenix.esnt.de XSS vulnerability

Vulnerable URL: https://phoenix.esnt.de/show.php?id=22=jQuery223079951473757511981487363049859%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 17.02.2017 Latest check for patch:| 17.02.2017 21:21 GMT Vulnerability type:| XSS Vulnerability status:|...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

Default credentials

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

CVE-2017-5159

The CVE-2017-5159 issue affects Phoenix Contact mGuard devices updated to version 8.4.0. During the upgrade via the update-upload facility, the update succeeds but resets the admin password to its default, enabling potential unauthorized admin access. Exploitation details are not provided beyond ...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

Phoenix Contact mGuard Security Bypass Vulnerability

Phoenix Contact mGuard is a security device from Phoenix Contact that protects systems from unauthorized access and installation. A security bypass vulnerability exists in Phoenix Contact mGuard. An attacker could use this vulnerability to bypass security restrictions and perform unauthorized...

PHOENIX CONTACT mGuard

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerability: Software update changes password to default AFFECTED PRODUCTS PHOENIX CONTACT reports that the vulnerability affects the following mGuard products: Only devices that hav...

Malware exploit: Phoenix

Phoenix Exploit Kit Initial Discovery Type: Remote Code Execution Author: CrashBandicot/@DosPerl Tested on: MSWin32 Vuln file : geoip.php 492. isset$GET'bdr' ? eval$GET'bdr' : explode'nop','nop nop nop'; PoC : http://localhost/Phoenix/includes/geoip.php?bdr=phpinfo; Screen :...

Reflected Cross-Site Scripting Vulnerability in WordPress Plugin Zhina Twitter Widget

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin Zhina Twitter Widget 'phoenixsearch.php' page, which can be exploited by attackers to...

Phoenix Contact ILC Authentication Bypass Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. An authentication bypass vulnerability exists in Phoenix Contact ILC PLCs, which can be exploited by an unauthenticated attacker to gain access to the web serve...

Phoenix Contact ILC Information Disclosure Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. An information disclosure vulnerability exists in Phoenix Contact ILC PLCs due to sensitive information being stored in clear text. An attacker could exploit th...