CVE-2017-7935

A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the device's availability by performing multiple initial VPN requests...

PHOENIX CONTACT mGuard

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerabilities: Resource Exhaustion, Improper Authentication AFFECTED PRODUCTS The following versions of mGuard, a network device, are affected: mGuard firmware versions 8.3.0 to 8.4....

phoenixgrp.com XSS vulnerability

Vulnerable URL: https://www.phoenixgrp.com/Join/?=joinformssshc=SSSH= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 850770 VIP website status:| No Check phoenixgrp.com SSL...

phoenixcontact.com XSS vulnerability

Vulnerable URL: https://www.phoenixcontact.com/online/portal/de?q=a%3E%27%3E%22%3Et%3Ci%3Ep%3Cimg+src%3Dy+onerror%3Dprompt%28%2Fopenbugbounty%2F%29%3E=pxc-search%3Awebsite=dede Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.09.2017 Vulnerability type:| XSS...

phoenixperennials.com XSS vulnerability

Vulnerable URL: http://www.phoenixperennials.com/nursery/listresults.php?query=%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 10:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

phoenix.esnt.de XSS vulnerability

Vulnerable URL: https://phoenix.esnt.de/show.php?id=22=jQuery223079951473757511981487363049859%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 17.02.2017 Latest check for patch:| 17.02.2017 21:21 GMT Vulnerability type:| XSS Vulnerability status:|...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

Default credentials

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

CVE-2017-5159

The CVE-2017-5159 issue affects Phoenix Contact mGuard devices updated to version 8.4.0. During the upgrade via the update-upload facility, the update succeeds but resets the admin password to its default, enabling potential unauthorized admin access. Exploitation details are not provided beyond ...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

Phoenix Contact mGuard Security Bypass Vulnerability

Phoenix Contact mGuard is a security device from Phoenix Contact that protects systems from unauthorized access and installation. A security bypass vulnerability exists in Phoenix Contact mGuard. An attacker could use this vulnerability to bypass security restrictions and perform unauthorized...

PHOENIX CONTACT mGuard

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerability: Software update changes password to default AFFECTED PRODUCTS PHOENIX CONTACT reports that the vulnerability affects the following mGuard products: Only devices that hav...

Malware exploit: Phoenix

Phoenix Exploit Kit Initial Discovery Type: Remote Code Execution Author: CrashBandicot/@DosPerl Tested on: MSWin32 Vuln file : geoip.php 492. isset$GET'bdr' ? eval$GET'bdr' : explode'nop','nop nop nop'; PoC : http://localhost/Phoenix/includes/geoip.php?bdr=phpinfo; Screen :...

Reflected Cross-Site Scripting Vulnerability in WordPress Plugin Zhina Twitter Widget

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin Zhina Twitter Widget 'phoenixsearch.php' page, which can be exploited by attackers to...

Phoenix Contact ILC Authentication Bypass Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. An authentication bypass vulnerability exists in Phoenix Contact ILC PLCs, which can be exploited by an unauthenticated attacker to gain access to the web serve...

Phoenix Contact ILC Security Bypass Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. A security bypass vulnerability exists in the Phoenix Contact ILC PLCs, which can be exploited by an unauthenticated attacker to access read and write PLC...

Phoenix Contact ILC Information Disclosure Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. An information disclosure vulnerability exists in Phoenix Contact ILC PLCs due to sensitive information being stored in clear text. An attacker could exploit th...

Phoenix Contact ILC PLC Authentication Vulnerabilities

OVERVIEW Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contact’s ILC inline controller PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to...

pcworx-info NSE Script

This NSE script will query and parse pcworx protocol to a remote PLC. The script will send a initial request packets and once a response is received, it validates that it was a proper response to the command that was sent, and then will parse out the data. PCWorx is a protocol and Program by...