CVE-2024-1628 OS command injection vulnerabilities in GE HealthCare ultrasound devices

OS command injection vulnerabilities in GE HealthCare ultrasound devices...

CVE-2024-1486 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices...

CVE-2024-1486 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices...

CVE-2024-1486

CVE-2024-1486 is a confirmed vulnerability in GE Healthcare ultrasound devices caused by a misconfigured access control list that enables elevation of privileges. The Red Hat/PT-security entries corroborate the flaw as an ACL misconfiguration that allows an attacker with local access to gain high...

PT-2024-3625 · Ge Healthcare · Ge Healthcare Echopac

Name of the Vulnerable Software and Affected Versions: GE HealthCare EchoPAC affected versions not specified Description: The issue is related to the use of predefined credentials in the software. Exploitation of this issue may allow a remote attacker to elevate privileges and execute arbitrary...

GHSA-7J7J-66CV-M239 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...

GHSA-HR5W-CWWQ-2V4M ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

Impact ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed imag...

rustavi2.ge Cross Site Scripting vulnerability OBB-3859274

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-3917 · Ge Healthcare · Ge Healthcare Echopac

Name of the Vulnerable Software and Affected Versions: GE HealthCare EchoPAC products affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in GE HealthCare EchoPAC products. It is associated with insufficient access control, which could allo...

PT-2024-3919 · Ge Healthcare · Common Service Desktop

Name of the Vulnerable Software and Affected Versions: Common Service Desktop versions affected versions not specified Description: The issue is related to a path traversal vulnerability in the getAllFolderContents function of the Common Service Desktop component in GE HealthCare ultrasound...

PT-2024-4039 · Ge Healthcare · Ge Healthcare Ultrasound Devices

Name of the Vulnerable Software and Affected Versions: GE HealthCare ultrasound devices affected versions not specified Description: The issue is related to incorrect permission assignment for a critical resource in GE HealthCare ultrasound devices. This can allow an attacker to gain unauthorized...

The software vulnerabilities of Kepware KEPServerEX, ThingWorx Industrial Connectivity, OPC-Aggregator, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server allow attackers to execute arbitrary code or cause service failures.

The vulnerabilities of the Kepware KEPServerEX, ThingWorx Industrial Connectivity, OPC-Aggregator, Rockwell Automation KEPServer Enterprise, and GE Digital Industrial Gateway Server software-related programs are related to the execution of operations outside the buffer in memory. Exploiting these...

The software of Kepware KEPServerEX, ThingWorx Industrial Connectivity, OPC-Aggregator, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server is vulnerable, allowing a attacker to cause service failures.

The vulnerabilities of the Kepware KEPServerEX, ThingWorx Industrial Connectivity, OPC-Aggregator, Rockwell Automation KEPServer Enterprise, and GE Digital Industrial Gateway Server software-related programs are related to the use of memory after it is freed. Exploiting these vulnerabilities can...

The vulnerabilities of the OPC-server software products such as KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity, OPC-Aggregator, ThingWorx Kepware Edge, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server, and Software Toolbox TOP Server are related to errors in the certificate validation process. These vulnerabilities allow attackers to bypass the certificate validation checks.

The vulnerabilities of the OPC-server software products such as KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity, OPC-Aggregator, ThingWorx Kepware Edge, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server, and Software Toolbox TOP Server are...

edu.gehealthcare.cn Cross Site Scripting vulnerability OBB-3783513

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-0898 Uncontrolled Search Path Element in GE MiCOM S1 Agile

General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application...

GE MiCOM S1 Agile

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Low attack complexity Vendor : General Electric Equipment : MiCOM S1 Agile Vulnerability : Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to upload malicious files and...

ge-stac.com Cross Site Scripting vulnerability OBB-3696278

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-G687-F2GX-6WM8 Argo CD repo-server Denial of Service vulnerability

Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious,...

Argo CD repo-server Denial of Service vulnerability

Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious,...