Improper access control

An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. The debug port accessible via TCP a qconn service lacks access control...

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...

CVE-2022-43977

GE Grid Solutions MS3000 devices are affected (versions before 3.7.6.25p0_3.2.2.17p0_4.7p0). The issue is an access-control flaw in the qconn TCP debug port, allowing unauthenticated network access to the debug interface. The root cause is lack of access control on the debug port, per multiple so...

CVE-2022-43977

An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. The debug port accessible via TCP a qconn service lacks access control...

CVE-2022-43975

The CVE-2022-43975 entry relates to FC46-WebBridge on GE Grid Solutions MS3000 devices, prior to versions 3.7.6.25p0, 3.2.2.17p0, and 4.7p0, where the web server is vulnerable to directory traversal that allows reading arbitrary files and configurations via TCP port 8888. This is a server-side pa...

CVE-2022-43977

An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. The debug port accessible via TCP a qconn service lacks access control...

Responsive Gallery Grid < 2.3.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Note: In ids, please add the image attachme...

CVE-2022-43975

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. A vulnerability in the web server allows arbitrary files and configurations to be read via directory traversal over TCP port 8888...

CVE-2022-43975

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. A vulnerability in the web server allows arbitrary files and configurations to be read via directory traversal over TCP port 8888...

GE Grid Solutions MS3000 安全漏洞

GE Grid Solutions MS3000 is a transformer monitoring system from GE Grid Solutions, France. A security vulnerability exists in GE Grid Solutions MS3000 versions prior to 3.7.6.25p03.2.2.17p04.7p0, which stems from a lack of access control...

GE Grid Solutions MS3000 路径遍历漏洞

GE Grid Solutions MS3000 is a transformer monitoring system from GE Grid Solutions, France. A security vulnerability exists in GE Grid Solutions MS3000 versions prior to 3.7.6.25p03.2.2.17p04.7p0. An attacker could exploit this vulnerability to read arbitrary files and configurations via director...

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...

PT-2023-14419 · Ge Grid Solutions · Ge Grid Solutions Ms3000

Name of the Vulnerable Software and Affected Versions: GE Grid Solutions MS3000 versions prior to 3.7.6.25p0 3.2.2.17p0 4.7p0 Description: An issue was discovered where the debug port accessible via TCP, utilizing a qconn service, lacks access control. This issue affects GE Grid Solutions MS3000...

CVE-2022-43976

The CVE-2022-43976 entry applies to FC46-WebBridge on GE Grid Solutions MS3000 devices prior to 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API on TCP port 8888 is possible via programs in the cgi-bin folder without authentication, exposing the API and data. The connected documents provide ...

WordPress Responsive Gallery Grid Plugin < 2.3.9 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Gallery Grid Type Plugin Vulnerable versions 2.3.9 Fixed in 2.3.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0060 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2a4cfaed0ac5 Credits Lana Codes...

Tiki 代码问题漏洞

Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. A security vulnerability exists in versions prior to Tiki 24.1 that stems from a PHP object injection i...

Post Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Smart Post Show"...

WordPress Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Plugin < 2.4.19 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Type Plugin Vulnerable versions 2.4.19 Fixed in 2.4.19 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0097 Patch priority Medium CVSS severity Medium 6.5 Developer Claim...

WordPress Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Plugin < 2.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post Grid, Post Carousel, & List Category Posts – by Smart Post Show Type Plugin Vulnerable versions 2.3.5 Fixed in 2.3.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Post Category Image With Grid and Slider Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

Software Post Category Image With Grid and Slider Type Plugin Vulnerable versions = 1.4.7 Fixed in 1.4.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID ff6be2f18b61 Credits N/A...