CVE-2020-16244

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

CVE-2020-16244

Ge Digital APM Classic (Versions 4.4 and prior) is affected by two vulnerabilities: (1) an IDOR-based vulnerability allowing unauthorized retrieval of user account data, and (2) use of a one-way hash without a salt, enabling password decryption. The combination creates a high-risk scenario for au...

CVE-2020-16240: Authorization Bypass Through User-Controlled Key

GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference IDOR vulnerability allows user account data to be downloaded in JavaScript object notation JSON format by users who should not have access to such functionality. An attacker can download sensitive data related to...

PT-2020-14833

Name of the Vulnerable Software and Affected Versions GE Digital APM Classic versions 4.4 and prior Description The issue allows an insecure direct object reference, enabling users without proper privileges to download user account data in JSON format. This can lead to the exposure of sensitive...

CVE-2020-16244: Use of a One-Way Hash without a Salt

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

PT-2020-14837

Name of the Vulnerable Software and Affected Versions GE Digital APM Classic versions 4.4 and prior Description The issue is related to a design flaw where salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This, combined with an IDOR vulnerability, puts...

GE Digital APM Classic

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Digital Equipment: APM Classic Vulnerabilities: Authorization Bypass Through User-controlled Key, Use of a One-Way Hash Without a Salt 2. RISK EVALUATION Successful exploitation of these...

myrights.gov.ge Cross Site Scripting vulnerability OBB-1259916

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Command Execution Vulnerability on Multiple Systems at Axis

Ltd. was founded on June 07, 2006, the new Zhucheng City, local enterprises and surrounding cities e-commerce application service team. A command execution vulnerability exists in several Ge-Xun systems, which can be exploited by attackers to gain server administrative privileges...

SQL Injection Vulnerability in the ge***.html Page of Vanlong Intelligent Recording and Broadcasting System

Hangzhou Fanlong Technology Co., Ltd. is a high-tech enterprise focusing on the research and development, production, sales and service of education informatization products, such as normalized recording and intelligent education. SQL injection vulnerability exists in the ge.html page of Vanlong'...

CVE-2020-12017

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...

CVE-2020-12017

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...

Authentication flaw

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...

CVE-2020-12017

CVE-2020-12017 affects GE Grid Solutions Reason RT Clocks RT430, RT431, and RT434 (firmware

CVE-2020-12017

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...

Denial of Service Vulnerability in Proficy Machine Edition (CNVD-2020-32606)

Proficy Machine Edition is a PLC programming software developed by Emerson Trading Shanghai Co., Ltd. for designing, debugging, programming, and maintaining GE RX 3i and GE RX7i series PLCs, which is widely used in industrial control fields such as electric power, machinery manufacturing, steel,...

PT-2020-12985

Name of the Vulnerable Software and Affected Versions GE Grid Solutions Reason RT Clocks versions prior to 08A05 GE Grid Solutions RT430 versions prior to 08A05 GE Grid Solutions RT431 versions prior to 08A05 GE Grid Solutions RT434 versions prior to 08A05 Description The device's web application...

CVE-2020-12017: Missing Authentication for Critical Function

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...

GE Grid Solutions Reason RT Clocks

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Low skill level to exploit/exploitable remotely Vendor: GE Equipment: Grid Solutions Reason RT Clocks Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow access to...

comune.avegno.ge.it Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1155740 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting comune.avegno.ge.it...