GE Digital CIMPLICITY

1. EXECUTIVE SUMMARY CVSS v3 6.0 ATTENTION: Low skill level to exploit Vendor: GE Digital Equipment: CIMPLICITY Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an adversary to modify the systemwide CIMPLICITY configuration,...

CVE-2020-6977

A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE...

Authentication flaw

A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE...

CVE-2020-6977

CVE-2020-6977 is a Kiosk Mode restricted-desktop-escape vulnerability in GE HealthCare ultrasound devices. Affected: Vivid (all versions), LOGIQ (all except LOGIQ 100 Pro), Voluson (all), Versana Essential (all), Invenia ABUS Scan station (all), Venue (all except Venue 40 R1-3 and Venue 50 R4-5)....

CVE-2020-6977

A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE...

GE Healthcare Ultrasound products (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION : low attack complexity Vendor : GE Healthcare Equipment : Ultrasound Products Vulnerability : Protection Mechanism Failure, Incorrect User Management 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker...

PT-2020-6969 · Ge Healthcare · Logiq +6

Name of the Vulnerable Software and Affected Versions: GE HealthCare Ultrasound Products versions all versions Vivid products versions all versions LOGIQ versions all versions, excluding LOGIQ 100 Pro Voluson versions all versions Versana Essential versions all versions Invenia ABUS Scan station...

Critical, Unpatched 'MDhex' Bugs Threaten Hospital Devices

A collection of six cybersecurity vulnerabilities in a range of GE Healthcare devices for hospitals has been discovered. Dubbed “MDhex” by the researchers at CyberMDX who discovered them, the bugs would allow attackers to disable the devices, harvest personal health information PHI, change alarm...

GE CARESCAPE, ApexPro, and Clinical Information Center systems

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: CARESCAPE Telemetry Server, ApexPro Telemetry Server, CARESCAPE Central Station CSCS and Clinical Information Center CIC systems, CARESCAPE B450, B650, B850 Monitors Vulnerabilities:...

CVE-2019-13524

GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versionsEnd of Life may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service...

Design/Logic Flaw

GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versionsEnd of Life may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service...

CVE-2019-13524

GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versionsEnd of Life may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service...

CVE-2019-13524

CVE-2019-13524 affects GE PACSystems RX3i: CPE100/115 (pre-R9.85), CPE302/305/310/330/400/410 (pre-R9.90), and CRU/320 (End of Life) with improper input validation. Sending specially manipulated packets can cause the module state to change to halt-mode, producing a denial-of-service condition. Re...

GE PACSystems Input Validation Error Vulnerability

GE PACSystems is a GE programmable automation controller product. GE PACSystems has an input validation error vulnerability that can be exploited by an attacker to cause a denial of service...

SQL injection vulnerability in the front-end ge***_aj***_co***.php file of Dascommerce B2B2C Multi-User Mall system

Shanghai Shangchuang Network Technology Co., Ltd. is an independent e-commerce service and technology provider with development strength. A SQL injection vulnerability exists in the front-end geajco.php file of the B2B2C multi-user mall system of Da Shangchuang. An attacker can exploit the...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

Cross site scripting

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-18267

The CVE-2019-18267 vulnerability affects GE S2020/S2020G Fast Switch 61850, specifically versions 07A03 and prior. It is a cross-site scripting flaw arising from improper input handling in the device’s web page generation, enabling both reflected and stored XSS that can lead to session hijacking,...