CVE-2024-1628

OS command injection vulnerabilities in GE HealthCare ultrasound devices...

CVE-2024-1486

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices...

CVE-2024-1628 OS command injection vulnerabilities in GE HealthCare ultrasound devices

OS command injection vulnerabilities in GE HealthCare ultrasound devices...

CVE-2024-1628 OS command injection vulnerabilities in GE HealthCare ultrasound devices

OS command injection vulnerabilities in GE HealthCare ultrasound devices...

CVE-2024-1486 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices...

CVE-2024-1486

CVE-2024-1486 is a confirmed vulnerability in GE Healthcare ultrasound devices caused by a misconfigured access control list that enables elevation of privileges. The Red Hat/PT-security entries corroborate the flaw as an ACL misconfiguration that allows an attacker with local access to gain high...

CVE-2024-1486 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices...

PT-2024-3770

Name of the Vulnerable Software and Affected Versions GE HealthCare EchoPAC products affected versions not specified Description The issue concerns insufficiently protected credentials in the software, which could allow an attacker to impact the confidentiality, integrity, and availability of...

PT-2024-3625 · Ge Healthcare · Ge Healthcare Echopac

Name of the Vulnerable Software and Affected Versions: GE HealthCare EchoPAC affected versions not specified Description: The issue is related to the use of predefined credentials in the software. Exploitation of this issue may allow a remote attacker to elevate privileges and execute arbitrary...

CVE-2024-27109: Insufficiently Protected Credentials

Insufficiently protected credentials in GE HealthCare EchoPAC products...

CVE-2024-27108: Incorrect Permission Assignment for Critical Resource

Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products...

CVE-2024-1629: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component...

CVE-2024-27106: Missing Encryption of Sensitive Data

Vulnerable data in transit in GE HealthCare EchoPAC products...

CVE-2024-1630: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component...

CVE-2024-1628: Improper Neutralization of Special Elements used in an OS Command

OS command injection vulnerabilities in GE HealthCare ultrasound devices...

CVE-2024-27107: Use of Hard-coded Credentials

Weak account password in GE HealthCare EchoPAC products...

CVE-2024-1486: Incorrect Permission Assignment for Critical Resource

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices...

CVE-2024-27110: Execution with Unnecessary Privileges

Elevation of privilege vulnerability in GE HealthCare EchoPAC products...

GHSA-7J7J-66CV-M239 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...

GHSA-HR5W-CWWQ-2V4M ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

Impact ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed imag...