CVE-2020-36547 GE Voluson S8 Service Browser hard-coded credentials

A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings...

PT-2022-8996

Name of the Vulnerable Software and Affected Versions GE Voluson S8 affected versions not specified Description A critical issue affects the Service Browser, which introduces hard-coded credentials. Local attack is required to exploit this issue. It is recommended to change the configuration...

CVE-2020-36547: Use of Hard-coded Credentials

A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings...

CVE-2020-36549: Improper Privilege Management

A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed...

GE Voluson 授权问题漏洞

GE Voluson is a diagnostic ultrasound solution from General Electric GE. A security vulnerability exists in GE Voluson S8 that originates from incorrect authentication in the service browser file /uscgi-bin/users.cgi. An attacker could exploit the vulnerability to launch an attack against the loc...

CVE-2020-36548: Improper Authentication

A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host...

PT-2022-8997

Name of the Vulnerable Software and Affected Versions GE Voluson S8 affected versions not specified Description A vulnerability has been found in the file /uscgi-bin/users.cgi of the Service Browser, leading to improper authentication and elevated access possibilities. The attack can be launched ...

PT-2022-8998

Name of the Vulnerable Software and Affected Versions GE Voluson S8 affected versions not specified Windows XP affected versions not specified Description A critical issue was found in the affected software, related to the underlying Windows XP operating system. The lack of patches may increase t...

Schneider Electric Uncontrolled Search Path Element in embedded Rockwell Automation ISaGRAF5 Runtime (CVE-2020-25182)

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft...

Rockwell Automation ISaGRAF5 Runtime Plaintext Storage of a Password (CVE-2020-25184)

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could...

Schneider Electric Cleartext Transmission of Sensitive Information in embedded Rockwell Automation ISaGRAF5 Runtime (CVE-2020-25178)

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote...

Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element (CVE-2020-25182)

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft...

The vulnerability of the set_fill function in the genge.c component of the Fig2dev file conversion utility allows a attacker to cause a service failure.

The vulnerability of the setfill function in the genge.c component of the Fig2dev file conversion utility is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to cause a service failure by converting the xfig file into the ge forma...

GE General Electric Renewable Energy MDS Radios 加密问题漏洞

GE General Electric Renewable Energy MDS Radios are a family of industrial wireless solutions from General Electric GE. GE General Electric Renewable Energy's MDS iNET/iNET II/SD/TD220/TD220MAX Radios are vulnerable to an encryption issue that stems from weaknesses in the wireless security softwa...

CVE-2021-44477

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

CVE-2021-44477

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

Xxe

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

CVE-2021-44477 GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

CVE-2021-44477 GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

CVE-2021-44477

CVE-2021-44477 affects GE Gas Power ToolBoxST OS running versions prior to 07.09.07C. It is an XML External Entity (XXE) vulnerability in the XML parser when processing project/template XML, using DTD parameter entities, potentially allowing disclosure of arbitrary data on the affected node via a...