PT-2024-21270 · Phoenix Contact · Charx Sec-3100 Charxupdateagent

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 CharxUpdateAgent affected versions not specified Description: An unauthenticated remote attacker can upload an arbitrary script file due to improper input validation. The upload destination is fixed and is write...

PHOENIX CONTACT CHARX SEC Buffer Error Vulnerability

The PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. The PHOENIX CONTACT CHARX SEC suffers from a buffer error vulnerability that stems from the presence of a buffer error vulnerability. An attacker could use this vulnerability to trigger a denial of...

PHOENIX CONTACT CHARX SEC Security Breach

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC, which stems from a lack of encryption of sensitive data in the MITM, resulting in an unauthenticated, remote attacker being able to...

PHOENIX CONTACT CHARX SEC Input Validation Error Vulnerability

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. An input validation error vulnerability exists in PHOENIX CONTACT CHARX SEC-3000 versions prior to v1.5.1, which stems from incorrect input validation and allows an unauthenticated local attacker to...

PHOENIX CONTACT CHARX SEC Command Injection Vulnerability

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. An input validation error vulnerability exists in PHOENIX CONTACT CHARX SEC-3000 versions prior to v1.5.1. The vulnerability stems from improper input validation, which allows an unauthenticated, remote...

PT-2024-21273 · Phoenix Contact · Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful...

PHOENIX CONTACT CHARX SEC Buffer Error Vulnerability

The PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A buffer error vulnerability exists in PHOENIX CONTACT CHARX SEC, which stems from a buffer error vulnerability. An attacker could exploit this vulnerability to trigger a denial of service via...

PHOENIX CONTACT CHARX SEC Input Validation Error Vulnerability

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. An input validation error vulnerability exists in PHOENIX CONTACT CHARX SEC-3000 versions prior to v1.5.1. The vulnerability stems from improper input validation, which allows an unauthenticated, remote...

Fedora: Security Advisory for plexus-sec-dispatcher (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Qognify VMS Client Viewer 7.1 DLL Hijacking

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local Privilege Escalation via DLL Hijacking product: Qognify VMS Client Viewer vulnerable version: =7.1 fixed version: see solution CVE number: CVE-2023-49114 impact:...

openSUSE: Security Advisory for avahi (SUSE-SU-2023:4901-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-52568: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer ksgxd may reclaim the SECS EPC page for an enclave and set secs.epcpage to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault...

CVE-2024-20905: Improper Resource Shutdown or Release

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are Prior to 9.2.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via JDENET to compromise JD...

CVE-2024-20937: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are Prior to 9.2.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD...

Algosec FireFlow Cross-Site Scripting Vulnerability

AlgoSec FireFlow is a security application from AlgoSec USA, Inc. It is used to automate the security policy change lifecycle, from submitting a change request to reviewing the changes made. A security vulnerability exists in Algosec FireFlow that stems from incorrect input validation...

Announcing TotalCloud™ 2.0 with TruRisk™ Insights: The Future of Cloud and SaaS Security

Rapid cloud and SaaS adoption is driving digital transformation thats reshaping business agility and scalability, making cloud and SaaS security more critical than ever. Recognizing this shift, in November 2022, Qualys launched TotalCloud – an AI-powered cloud-native application protection platfo...

PT-2024-8065 · Phoenix Contact · Phoenix Contact Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: The issue is related to improper input validation and a missing authentication procedure, allowing an unauthenticated remote attacker to modify configurations. This c...

Statmic CMS vulnerable to account takeover via XSS and password reset link

Impact HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects: - front-end forms with asset fields without any mime type validation - asset fields in the control panel - asset browser in the control panel Additionally, if the XSS is crafted in a specific...

GHSA-VQXQ-HVXW-9MV9 Statmic CMS vulnerable to account takeover via XSS and password reset link

Impact HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects: - front-end forms with asset fields without any mime type validation - asset fields in the control panel - asset browser in the control panel Additionally, if the XSS is crafted in a specific...

The SEC Won't Let CISOs Be: Understanding New SaaS Cybersecurity Rules

The SEC isn't giving SaaS a free pass. Applicable public companies, known as "registrants," are now subject to cyber incident disclosure and cybersecurity readiness requirements for data stored in SaaS systems, along with the 3rd and 4th party apps connected to them. The new cybersecurity mandate...