Pilz

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-9011 1Pilz 1Pmc Apr 14, 2025 Dec 26, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.
CVE-2020-12069 4Codesys FestoPilz+1 more 64750 8100 Firmware 750 8101 Firmware750 8102 Firmware+61 more May 5, 2025 Dec 26, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local a...Show more In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.Show less
CVE-2020-12067 1Pilz 1Pmc Apr 14, 2025 Dec 26, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.
CVE-2022-40977 1Pilz 8Pasvisu Pmi V507 FirmwarePmi V512 Firmware+5 more Nov 21, 2024 Nov 24, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File...Show more A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability. Show less
CVE-2022-40976 2Pilz Pliz 5Pas 4000 PascalPasconnect+2 more Nov 21, 2024 Nov 24, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do no...Show more A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.Show less
CVE-2018-19009 1Pilz 1Pnozmulti Configurator Nov 21, 2024 Jan 25, 2019 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sens...Show more Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker with access to this sensitive data and physical access to the PMI m107 diag can modify data on the HMI device.Show less