(Pwn2Own) Phoenix Contact CHARX SEC-3150 update2-upload Arbitrary File Upload Vulnerability

This vulnerability allows network-adjacent attackers to upload arbitrary files on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is required to exploit this vulnerability. The specific flaw exists within the update2-upload endpoint. The issue results from the lac...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 Filename Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2022-26247

TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password...

CVE-2022-26247

TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password...

PT-2022-17740

Name of the Vulnerable Software and Affected Versions TMS version 2.28.0 Description The issue is related to insecure permissions in the component "/TMS/admin/user/Update2". This allows attackers to modify the administrator account and password. Recommendations For TMS version 2.28.0, consider...

TMS 安全漏洞

TMS is a channel-based team communication and collaboration + lightweight task dashboard by weicheng individual developers. A security vulnerability exists in TMS v2.28.0, which originates from an insecure privilege in the component /TMS/admin/user/Update2. The vulnerability can be exploited to...

CVE-2022-26247: Incorrect Permission Assignment for Critical Resource

TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password...

Command injection

Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management NSM 9.1 9.1.7.75 Update 4 and 9.2 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands...