18 results · Clear filters · Feed
-
Critical max 9.2
MB connect line: php2shell in mbCONNECT24/mymbCONNECT24
MB connect line mbCONNECT24/mymbCONNECT24 ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
Critical max 9.2
Helmholz: php2shell in myREX24V2/myREX24V2.virtual
Helmholz myREX24V2/myREX24V2.virtual ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
Critical max 9.8
Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG)
Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 and CVE-2025-39964) to its Known Exploited Vulnerabilities catalog. Bender has anal…
-
Critical max 9.2
Two critical PHP vulnerabilities in several Festo Didactic products
Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vu…
first Nov 2, 2026 -
Critical max 9.2
WAGO: Multiple Devices affected by PHP2Shell
Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpect…
first Nov 2, 2026 -
Critical max 9.2
Welotec: PHP2Shell Vulnerabilities in SMART EMS
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability…
-
Critical max 9.2
METTLER TOLEDO: PHP2Shell in Octo Image Server
OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.
-
Critical max 9.3
Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
-
Critical max 9.8
Several CODESYS vulnerabilities in Festo Automation Suite
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwar…
-
Critical max 9.8
Festo: Several vulnerabilities in FactoryViews
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of Facto…
first Jul 10, 2023 -
Critical max 9.8
Several Vulnerabilities in MES PC (Windows 10)
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. …
first Feb 27, 2024 -
Critical max 9.3
WAGO: Critical sudo Vulnerability in Multiple Products
A vulnerability in sudo allows a low privileged attacker to execute commands with root rights.
-
Critical max 10.0
WAGO: Smart Script affected by Log4Shell Vulnerability
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers …
first Jan 5, 2022 -
Critical max 8.8
Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS
first Dec 9, 2024 -
Critical max 9.8
Pepperl+Fuchs: Multiple VDM100-Distance Ethernet-IP sensors with multiple vulnerabilities
Critical vulnerabilities have been discovered in the utilized component TRECK TCP/IP Stack by Digi International Inc. For more information see advisory by Digi International Inc.: Digi International Security Notice - TRECK TCP/IP Stack "RIPPLE20" VU#257161 IC…
first Aug 16, 2021 -
Critical max 9.8
Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service
Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1. The impact of the vulnerabilities on the affected device may result in - denial of service - remote code execution - cod…
first Oct 16, 2021 -
Critical max 9.8
Miele: Treck TCP/IP Vulnerabilities (Ripple20) affecting Communication Module XKM3000 L MED
For process data documentation purposes the laboratory washers, thermal disinfectors and washer-disinfectors can be integrated in a TCP/IP network by utilizing the affected communication module. The communication module is separate from the actual device cont…
first Jul 8, 2020 -
Critical max 9.8
Pepperl+Fuchs: Remote code execution vulnerability in HMI devices
A remote code execution vulnerability exists in **Remote Desktop Services** – formerly known as **Terminal Services** – when an unauthenticated attacker connects to the target system using **RDP** and sends specially crafted requests. This vulnerability is **…
first May 29, 2019