CVE-2022-42786

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage...

Design/Logic Flaw

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage...

Design/Logic Flaw

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be...

CVE-2022-42787

Wiesemann & Theis Comserver Series (W&T Comserver) is affected by CVE-2022-42787 due to using a small number space for session IDs. After a user logs in, an unauthenticated remote attacker can brute-force a valid session ID to gain access to the user’s account on the device. User interaction is r...

CVE-2022-42786

CVE-2022-42786 concerns the Wiesemann & Theis ComServer Series web interface. The vulnerability is an XSS flaw in the configuration webpage title, allowing an authenticated remote attacker to inject and execute arbitrary web scripts/HTML. The root cause is described in a few sources as an imprope...

CVE-2022-42785

CVE-2022-42785 affects Wiesemann & Theis ComServer Series (serial device servers). The authenticated bypass allows an unauthenticated remote attacker to log in without a password by crafting a modified HTTP GET request. The vulnerability is documented across multiple sources (NVD, CVE list, Nessu...

PT-2022-26577 · Unknown · Comserver Series

Name of the Vulnerable Software and Affected Versions: ComServer Series affected versions not specified Description: The issue allows an authenticated remote attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage. This is a...

PT-2022-26578 · W&T · W&T Comserver Series

Name of the Vulnerable Software and Affected Versions: W&T Comserver Series products affected versions not specified Description: The issue concerns the allocation of session IDs, which uses a small number space. This allows an unauthenticated remote attacker to brute force a user's session ID...

PT-2022-26576 · Unknown · Comserver Series

Name of the Vulnerable Software and Affected Versions: ComServer Series affected versions not specified Description: The issue allows an unauthenticated remote attacker to bypass authentication and log in without knowledge of the password by crafting a modified HTTP GET Request. Recommendations: ...

CVE-2021-21002

In Phoenix Contact FL COMSERVER UNI in versions 2.40 a invalid Modbus exception response can lead to a temporary denial of service...

CVE-2021-21002

In Phoenix Contact FL COMSERVER UNI in versions 2.40 a invalid Modbus exception response can lead to a temporary denial of service...

Denial of service

In Phoenix Contact FL COMSERVER UNI in versions 2.40 a invalid Modbus exception response can lead to a temporary denial of service...

CVE-2021-21002

CVE-2021-21002 affects Phoenix Contact FL COMSERVER UNI in versions

CVE-2021-21002 Denial of Service in Phoenix Contact FL COMSERVER UNI products

In Phoenix Contact FL COMSERVER UNI in versions 2.40 a invalid Modbus exception response can lead to a temporary denial of service...

Phoenix Contact FL COMSERVER UNI 安全漏洞

The Phoenix Contact FL COMSERVER UNI is an interface converter from Phoenix Contac Phoenix Contact, Germany. Serial Device Server for Converting Serial 232/422/485 Interfaces to Ethernet A security vulnerability exists in the Phoenix Contact FL COMSERVER UNI, which stems from an invalid Modbus...

Cross site scripting

A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH running firmware versions prior to 1.99, 2.20, o...

CVE-2017-16723

A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH running firmware versions prior to 1.99, 2.20, o...

CVE-2017-16723

A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH running firmware versions prior to 1.99, 2.20, o...

CVE-2017-16723

The CVE-2017-16723 issue affects Phoenix Contact FL COMSERVER family and PSI-MODEM/ETH devices (BASIC/UNI/BAS/UNI-T/RS232/RS485) with firmware versions before 1.99, 2.20, or 2.40. Root cause: improper neutralization of input during web page generation (CWE-79), enabling Cross‑Site Scripting that ...

Multiple Phoenix Contact Product Cross-Site Scripting Vulnerabilities

Phoenix Contact FL COMSERVER, serial device server that converts serial signals to Ethernet. PLC I/O module FL COMSERVER UNI 232/422/485, interfaces to Ethernet, supports TCP and UDP. A cross-site scripting vulnerability exists in multiple Phoenix Contact products that stems from a failure to...