PT-2022-1906

Name of the Vulnerable Software and Affected Versions GE Reason RT430, RT431, and RT434 GNSS clocks versions prior to 08A06 Description The issue is related to a code injection vulnerability. This vulnerability could allow a remote attacker to execute arbitrary code on the system. The vulnerabili...

CVE-2020-25197: Improper Control of Generation of Code

A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system...

CISA Warns of High-Severity Flaws in Schneider and GE Digital's SCADA Software

The U.S. Cybersecurity and Infrastructure Security Agency CISA last week published an industrial control system ICS advisory related to multiple vulnerabilities impacting Schneider Electric's Easergy medium voltage protection relays. "Successful exploitation of these vulnerabilities may disclose...

ge-realty.com Cross Site Scripting vulnerability OBB-2385255

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ge-indonesia.com Cross Site Scripting vulnerability OBB-2385254

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Privilege escalation

Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and t...

CVE-2022-21798 ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext

The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system...

CVE-2022-23921 ICSA-22-053-01 GE Proficy CIMPLICITY-IPM

Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and t...

CVE-2022-23921 ICSA-22-053-01 GE Proficy CIMPLICITY-IPM

Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and t...

CVE-2022-23921

CVE-2022-23921 affects GE Proficy CIMPLICITY-IPM. Root cause: improper privilege management (CWE-269) leading to local privilege escalation and code execution. Exploitation requires local access: attacker must log in to a CIMPLICITY machine where the CIMPLICITY server is not running a project and...

PT-2022-16337

Name of the Vulnerable Software and Affected Versions GE CIMPLICITY affected versions not specified Description Exploitation of this issue may result in local privilege escalation and code execution. It is noted that exploitation is only possible if the attacker has login access to a machine...

GE Proficy CIMPLICITY-IPM

1. EXECUTIVE SUMMARY CVSS v3 7.5 Vendor: GE Equipment: Proficy CIMPLICITY Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve both code execution and local privilege escalation. 3. TECHNICAL DETAILS 3.1...

GE Proficy CIMPLICITY-Cleartext

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: GE Equipment: Proficy CIMPLICITY Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to capture a...

GE PACSystems RX3i Improper Input Validation (CVE-2019-13524)

GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versionsEnd of Life may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service...

GE PACSystems CPE305/310, CPE330, CPE400, RSTi-EP CPE 100, CPU320/CRU320, RXi Improper Input Validation (CVE-2018-8867)

In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacke...

PT-2022-1741

Name of the Vulnerable Software and Affected Versions GE Gas Power ToolBoxST version v04.07.05C Description The issue is related to an XML external entity XXE vulnerability using the DTD parameter entities technique. This could result in the disclosure and retrieval of arbitrary data on the...

GE Gas Power ToolBoxST

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: GE Gas Power Equipment: ToolBoxST Vulnerabilities: Improper Restriction of XML External Entity Reference, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result...

PT-2021-26841

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.292 Description: A possible array overflow issue exists in the hns dsaf ge srst by port function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

PT-2021-26858

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.257 Description A possible array overflow issue exists in the hns dsaf ge srst by port function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-26952

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.84 Description A possible array overflow issue exists in the hns dsaf ge srst by port function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...