CVE-2020-12518

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks...

Design/Logic Flaw

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot...

Privilege escalation

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website local privilege escalation...

Information disclosure

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks...

CVE-2020-12519 Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges...

CVE-2020-12521 Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the PROFINET stack.

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot...

CVE-2020-12517

Summary: Phoenix Contact PLCnext Control Devices (prior to 2021.0 LTS) are affected by a cross-site scripting vulnerability. An authenticated, low-privileged user can embed malicious JavaScript that executes when an administrator visits the vulnerable web interface, leading to local privilege esc...

CVE-2020-12517 Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website local privilege escalation...

CVE-2020-12519

CVE-2020-12519 affects Phoenix Contact PLCnext Control Devices prior to 2021.0 LTS. The vulnerability allows an attacker to open a reverse shell with root privileges. The provided sources confirm this impact but do not specify the root-cause details or a patched version within the connected docum...

CVE-2020-12521

CVE-2020-12521 concerns Phoenix Contact PLCnext Control Devices (pre-2021.0 LTS). A specially crafted LLDP packet can cause a high load in the PROFINET stack, potentially leading to system service failures or a complete reboot. The vulnerability is described across multiple sources as an input va...

CVE-2020-12518

CVE-2020-12518 affects Phoenix Contact PLCnext Control Devices released before 2021.0 LTS. The vulnerability is an information disclosure flaw where an attacker can read insufficiently protected sensitive information to plan further attacks. The CVSS metrics indicate partial confidentiality impac...

Phoenix Contact PLCnext Control Devices 跨站脚本漏洞

Phoenix Contact PLCnext Control Devices is a programmable logic controller for industrial environments from Phoenix Contact. A cross-site scripting vulnerability exists in Phoenix Contact PLCnext Control Devices prior to version 2021.0 LTS, which originates from an authenticated, low-privileged...

The vulnerabilities of BIG-IP and BIG-IQ access control and remote authentication mechanisms, related to access control errors, allow attackers to escalate their privileges.

The vulnerability of BIG-IP Access Policy Manager and BIG-IQ access control devices lies in access control errors. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2018-19588

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control...

CVE-2018-19588

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control...

Guangzhou Chaoran Computer Co., Ltd.'s EL-100 Series Industrial Control Devices Have Override Access and Weak Password Vulnerabilities

The EL-100 Series Serial Device Networking Server allows serial devices to be networked immediately and directly accessible through software. Vulnerabilities exist in the EL-100 series of industrial control devices of Guangzhou Chaoran Computer Co. Ltd. for override access and weak password...

Hackers Used Malicious MDM Solution to Spy On 'Highly Targeted' iPhone Users

Security researchers have uncovered a "highly targeted" mobile malware campaign that has been operating since August 2015 and found spying on 13 selected iPhones in India. The attackers, who are also believed to be operating from India, were found abusing mobile device management MDM protocol—a...

HID VertX Detection (discoveryd)

Detection of HID VertX Access Control Devices. The script sends a connection request to the server and attempts to detect HID VertX Access Control Devices and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

CVE-2015-2870

CVE-2015-2870 affects Chiyu BF-630, BF-630W and BF-660C fingerprint access-control devices. The vulnerability is a cross-site scripting (XSS) flaw that lets remote attackers inject arbitrary web script or HTML via a SCRIPT element, typically through a URL passed to the device. The related CERT/CC...

CVE-2015-2870

Cross-site scripting XSS vulnerability on Chiyu BF-630, BF-630W, and BF-660C fingerprint access-control devices allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element...