EUVD-2024-24360

Malicious code in bioql PyPI...

EUVD-2024-24358

Malicious code in bioql PyPI...

EUVD-2022-35173

Malicious code in bioql PyPI...

EUVD-2025-7760

Malicious code in bioql PyPI...

EUVD-2024-17369

Malicious code in bioql PyPI...

EUVD-2023-12636

Malicious code in bioql PyPI...

EUVD-2022-46944

Malicious code in bioql PyPI...

GE S2020/S2020G Fast Switch 61850 Improper Neutralization of Input During Web Page Generation (CVE-2019-18267)

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

GE Reason S20 Ethernet Switch Improper Neutralization of Input During Web Page Generation (CVE-2020-16242)

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts. This plugin only works with Tenable.ot. Please...

GE Reason S20 Ethernet Switch Improper Neutralization of Input During Web Page Generation (CVE-2020-16246)

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...

GE UR family Improper Input Validation (CVE-2021-27418)

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTM...

GE UR family Improper Input Validation (CVE-2021-27420)

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By...

GE Multilin UR Family Inadequate Encryption Strength (CVE-2013-2566)

Prior to UR firmware Version 8.1x, UR supported various encryption and MAC algorithms for SSH communication, some of which are weak. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

GE UR family Unrestricted Upload of File with Dangerous Type (CVE-2021-27428)

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

GE Multilin UR Family Inadequate Encryption Strength (CVE-2016-2183)

Prior to UR firmware Version 8.1x, UR supported various encryption and MAC algorithms for SSH communication, some of which are weak. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

GE UR family Insecure Default Variable Initialization (CVE-2021-27426)

GE UR IED firmware versions prior to version 8.1x with Basic security variant does not allow the disabling of the Factory Mode, which is used for servicing the IED by a Factory user. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

GE UR family Exposure of Sensitive Information to an Unauthorized Actor (CVE-2021-27424)

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a Last-key pressed MODBUS register can be used to gain unauthorized information. This plugin only works with Tenable.ot. Please visit...

CVE-2025-10944

A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. This product uses a rolling...

CVE-2025-10944

The CVE-2025-10944 entry concerns yi-ge get-header-ip:ip.php, where the callback argument in the ip function can be manipulated to trigger cross-site scripting. Affected versions are those prior to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. The weakness can be exploited remotely via network access...

CVE-2025-10944 yi-ge get-header-ip ip.php cross site scripting

A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. This product uses a rolling...