1702 matches found
Input validation
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory...
CVE-2021-34597
CVE-2021-34597 affects Phoenix Contact PC Worx Automation Suite (up to version 1.88). The root cause is improper input validation in project files, enabling a manipulated project to unpack arbitrary files outside the selected directory. NVD reports CVSS v2 base score 6.8 (NETWORK, partial impact)...
CVE-2021-34597 Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerability
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory...
Phoenix Contact Automation Worx Software Suite 输入验证错误漏洞
Phoenix Contact Automation Worx Software Suite is an automation Worx software suite from Phoenix Contact, Germany. An input validation error vulnerability exists in Phoenix Contact's PC Worx Automation Suite, which stems from an incorrect input validation vulnerability in version 1.88. An attacke...
phoenixequine.co.uk Improper Access Control vulnerability OBB-2228813
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Phoenix Media Rename plugin <= 3.4.2 - Arbitrary Media File Renaming vulnerability
Arbitrary Media File Renaming vulnerability discovered by apple502j in WordPress Phoenix Media Rename plugin versions = 3.4.2. Solution Update the WordPress Phoenix Media Rename plugin to the latest available version at least 3.4.4...
Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
The plugin does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own. PoC As an Author, go to the page to edit one of your own Media ie /wp-admin/post.php?post=1993=edit, whic...
Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
The plugin does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own. As an Author, go to the page to edit one of your own Media ie /wp-admin/post.php?post=1993&action=edit,...
CVE-2021-34570
Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...
CVE-2021-34570
Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...
Code injection
Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...
CVE-2021-34570 Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS
Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...
CVE-2021-34570
Phoenix Contact PLCnext Control devices (versions prior to 2021.0.5 LTS) are affected by CVE-2021-34570. The issue is a DoS caused by specially crafted JSON requests, reducing availability. The NVD/CVSS reports a HIGH impact with network attack vector and low complexity. Remediation in the provid...
Phoenix Contact PLCnext Control Devices 输入验证错误漏洞
Phoenix Contact PLCnext Control Devices is a programmable logic controller for industrial environments from Phoenix Contact, Germany. An input validation error vulnerability exists in Phoenix Contact PLCnext Control Devices prior to version 2021.0.5LTS, which stems from the control device being...
chuckroppphoenixrealtor.com Cross Site Scripting vulnerability OBB-2146365
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
phoenix-futures.org.uk Cross Site Scripting vulnerability OBB-2139599
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CNA legal filings lift the curtain on a Phoenix CryptoLocker ransomware attack
Two months after fully restoring its systems, CNA Financial, the leading US insurance company that was attacked by a group using Phoenix CryptoLocker ransomware, issued a legal notice of an information security incident to the Consumer Protection Bureau in New Hampshire. You may recall that Phoen...
File Upload Vulnerability in WORMCMS of Shanghai Yanfeng Information Technology Co.
WORMCMS is open source and free PHP enterprise website development and construction management system. Shanghai Yanfeng Information Technology Co. WORMCMS file upload vulnerability, an attacker can use the vulnerability to obtain control of the server...
Arbitrary File Read Vulnerability in WORMCMS of Shanghai Yanfeng Information Technology Co.
WORMCMS is open source and free PHP enterprise website development and construction management system. Shanghai Yanfeng Information Technology Co. WORMCMS has an arbitrary file reading vulnerability, which can be exploited by attackers to obtain sensitive information...
Phoenix Contact Classic Automation Worx Software Suite Buffer Overflow Vulnerability
Phoenix Contact Classic Automation is a division of Phoenix Contac Phoenix Contact, a German company that provides surplus parts and Phoenix Contact repair services. A security vulnerability exists in Software Suite 1.87 and prior versions, which stems from a vulnerability that can be exploited b...