xopera.site.ge vulnerability

Open Bug Bounty ID: OBB-118247 Description| Value ---|--- Affected Website:| xopera.site.ge Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerable URL: http://xopera.site.ge/send.php?link=https://www.xssposed.org/=17 Coordinat...

GE Hydran M2 Predictable TCP Initial Sequence Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on February 10, 2015, and is being released to the NCCIC/ICS-CERT web site. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a research project partially sponsored by the Georgia Tech National...

GE Multilink Switch Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-013-04 GE MultiLink Switch Vulnerabilities that was published January 13, 2015, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 3 -------- Eireann Leverett of IOActive has identified three...

GE MDS PulseNET Hidden Support Account Remote Code Execution (CVE-2015-6456)

A default credential vulnerability has been reported in GE MDS PulseNET. The vulnerability is due to static credentials of a hidden support account permitting administrator access to the system. A remote attacker can exploit these default credentials to access the system. Once authenticated, the...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Absolute Path Traversal Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password...

Path traversal

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are affected versions prior to 3.1.5, which contain hard-coded credentials for a hidden support account. This enables remote attackers to obtain administrative access and potentially execute arbitrary code. Public advisories (ZDI-15-440; ...

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password...

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6459

CVE-2015-6459 covers an absolute path traversal in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise FileDownloadServlet prior to version 3.1.5. The vulnerability arises from insufficient validation in the download function, allowing remote attackers to read or delete arbitrary files via...

GE MDS PulseNET FileDownloadServlet Directory Traversal Information Disclosure And Deletion Vulnerability

This vulnerability allows remote attackers to read and delete arbitrary files on vulnerable installations of GE MDS PulseNET. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FileDownloadServlet. By specifying a filename including directory...

GE MDS PulseNET Hidden Support Account Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE MDS PulseNET. Authentication is required to exploit this vulnerability but it can bypassed using static credentials. The specific flaw exists within the PulseNET web service. It contains a hidde...

GE Healthcare Optima MR360 Built-in Account Vulnerability

The GE Healthcare Optima MR360 is a magnetic resonance imaging MRI system for the healthcare industry. The GE Healthcare Optima MR360 fails to properly verify login authentication, allowing remote attackers to exploit the vulnerability by submitting a special request to gain access...

GE Healthcare CADStream Server Built-in Account Vulnerability

GE Healthcare CADStream Server is a suite of applications used in the healthcare industry and provides automated analysis and reporting for magnetic resonance imaging. GE Healthcare CADStream Server has built-in accounts, and admin uses 'confirma' passwords, allowing remote attackers to utilize...

GE Healthcare Revolution XQ/i Built-in Account Vulnerability

Acquisition Workstation for the GE Healthcare Revolution XQ/i is a digital radiography acquisition workstation for the healthcare industry. The Acquisition Workstation for the GE Healthcare Revolution XQ/i has built-in accounts, and the sdc uses 'adw3.1' passwords, allowing remote attackers to ta...

GE Healthcare Centricity PACS-IW Built-in Account Vulnerability (CNVD-2015-05174)

GE Healthcare Centricity PACS-IW is an image archiving and delivery system for the healthcare industry. GE Healthcare Centricity PACS-IW has built-in accounts for sa users with 'A11enda1e' passwords, allowing remote attackers to take control of the device using these accounts...

GE Healthcare Optima Built-in Account Vulnerability

The GE Healthcare Optima CT680, CT540, CT640, and CT520 are General Electric Company's computed tomography products used in the medical industry. The GE Healthcare Optima CT680, CT540, CT640, and CT520 use a root account with the password 'bigguy', allowing remote attackers to take control of the...

Trust Management Vulnerabilities in Multiple GE Products (CNVD-2015-05133)

GE Healthcare Millennium MG, NC and MyoSIGHT are General Electric GE scanning camera products for the healthcare industry. The security vulnerability in several GE products stems from the program's use of default passwords username: root password: root.genie, username: service password: service.,...