phoenix-nieder-olm.de Improper Access Control vulnerability OBB-3767695

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

phoenix-plus.be Cross Site Scripting vulnerability OBB-3763783

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-7874 · Phoenix Contact · Phoenix Contact Multiprog +1

Name of the Vulnerable Software and Affected Versions: PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR SDK affected versions not specified Description: The issue is related to the download of code without integrity checks, allowing an unauthenticated remote attacker to download and execu...

The vulnerability of the microprogramming software of the PHOENIX CONTACT TC ROUTER, TC CLOUD CLIENT, and CLOUD CLIENT arises from the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the microprogrammed software of the PHOENIX CONTACT TC ROUTER, TC CLOUD CLIENT, and CLOUD CLIENT exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a...

The vulnerability of the microprogramming software for routers PHOENIX CONTACT TC ROUTER, TC CLOUD CLIENT, and CLOUD CLIENT arises from incorrect restrictions on XML links to external objects. This allows attackers to cause service failures.

The vulnerability of the microprogramming software for routers PHOENIX CONTACT TC ROUTER, TC CLOUD CLIENT, and CLOUD CLIENT is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failur...

phoenix-auction.com Cross Site Scripting vulnerability OBB-3710529

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-42446

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

Design/Logic Flaw

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

CVE-2023-42446

Pow is a Phoenix/Plug authentication library. CVE-2023-42446 affects Pow.Store.Backend.MnesiaCache in versions 1.0.14 up to, but not including, 1.0.34, where expired keys are not correctly invalidated on startup, allowing potential session hijacking if all MnesiaCache instances are down past a se...

CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expi...

truckpartsphoenix.com Cross Site Scripting vulnerability OBB-3669603

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems, PHOENIX CONTACTs WP 6xxx, allows a perpetrator to gain full access to the device.

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems like PHOENIX CONTACT WP 6xxx exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a malicious actor, operating remotely,...

Phoenix Contact TC ROUTER and TC CLOUD CLIENT

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Phoenix Contact Equipment : TC ROUTER and TC CLOUD CLIENT Vulnerabilities : Cross-site Scripting, XML Entity Expansion 2. RISK EVALUATION Successful exploitation of this...

phoenixlasermd.com Cross Site Scripting vulnerability OBB-3651391

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

phoenix-2019.com Cross Site Scripting vulnerability OBB-3651382

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-7877 · Phoenix Contact · Phoenix Contact Multiprog +1

Name of the Vulnerable Software and Affected Versions: PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR SDK affected versions not specified Description: The issue is related to an Incorrect Permission Assignment for Critical Resource, which allows an unauthenticated remote attacker to...

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems from PHOENIX CONTACTs WP 6xxx exists due to the lack of measures taken to neutralize special elements used in the operating system command set. This vulnerability allows a perpetrator to execute arbitrary code.

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execut...

Phoenix Technologies Windows kernel driver vulnerable to insufficient access control on its IOCTL

Overview Some of the Windows kernel drivers provided by Phoenix Technologies Inc. is vulnerable to insufficient access control on its IOCTL CWE-782, CVE-2023-35841. Takahiro Haruyama of VMware reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact By sending a...