Vulnerabilities > GE > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-18 | CVE-2022-43494 | Unspecified vulnerability in GE Proficy Historian An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. | 6.5 |
| 2023-01-18 | CVE-2022-46660 | Unspecified vulnerability in GE Proficy Historian An unauthorized user could alter or write files with full control over the path and content of the file. | 6.5 |
| 2022-12-26 | CVE-2022-24120 | Cleartext Storage of Sensitive Information vulnerability in GE products Certain General Electric Renewable Energy products store cleartext credentials in flash memory. | 4.6 |
| 2022-08-25 | CVE-2022-37952 | Cross-site Scripting vulnerability in GE Workstationst A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. | 6.1 |
| 2022-08-25 | CVE-2022-37953 | Unspecified vulnerability in GE Workstationst An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. | 6.1 |
| 2022-03-23 | CVE-2021-27418 | Cross-site Scripting vulnerability in GE products GE UR firmware versions prior to version 8.1x supports web interface with read-only access. | 6.1 |
| 2022-03-23 | CVE-2021-27420 | Improper Input Validation vulnerability in GE products GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. | 5.3 |
| 2022-03-23 | CVE-2021-27424 | Exposure of Resource to Wrong Sphere vulnerability in GE products GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. | 5.3 |
| 2022-03-23 | CVE-2021-27430 | Use of Hard-coded Credentials vulnerability in GE UR Bootloader Binary 7.00/7.01/7.02 GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. | 6.8 |
| 2022-03-18 | CVE-2020-25193 | Use of Hard-coded Credentials vulnerability in GE Rt430 Firmware, Rt431 Firmware and Rt434 Firmware By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection. | 5.3 |