Skip to content
OpenAdvisories
High ICSA-22-025-01 2 CVEs

GE Gas Power ToolBoxST

Published Jan 25, 2022 · Updated Jan 25, 2022

Vendor: General Electric (GE) Product: ToolBoxST OS

Summary

Successful exploitation of these vulnerabilities could result in data exfiltration or arbitrary write, overwrite, and execution.

Vulnerabilities 2

  • High 8.6
    CVE-2018-16202

    Path Traversal in cordova-plugin-ionic-webview

    Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.

    npm cordova-plugin-ionic-webview cordova-plugin-ionic-webview npm
  • High 7.5
    CVE-2021-44477

    GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

    GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. …

    GE Gas Power ToolBoxST

Revision history

  1. #1

    ICSA-22-025-01 GE Gas Power ToolBoxST

References