Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Release: Secomea GateManager 9.7 Clear all filters
TI-2022-09358 CVE-2022-25786 · GHSA-q4gh-2cv2-8pcv

GateManager debug interface is included in production builds

Priority LOW 24

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00737 Published 2022-05-04 Fixed in 9.7 CWE-420
TI-2022-09359 CVE-2022-25787 · GHSA-g4xm-ww43-jwfq

GTA URLs issued by LMM WEB API may leak information

Priority LOW 32

Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection.

CVSS 3.1HIGH 7.5 Local High privileges No interaction EPSS 0.00242 Published 2022-05-04 Fixed in 9.7 CWE-598
TI-2022-09354 CVE-2022-25782 · GHSA-8jpc-hjx4-frf2

Insufficient privilege checks on object access and updates.

Priority LOW 25

Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.005 Published 2022-05-04 Fixed in 9.7 CWE-274
TI-2022-09353 CVE-2022-25781 · GHSA-r4mf-x9jp-4g78

Reflected XSS issues in GateManager

Priority LOW 28

Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00495 Published 2022-05-04 Fixed in 9.7 CWE-79
TI-2022-09352 CVE-2022-25780 · GHSA-wpqj-cmjr-jpxj

Information leak via device availability query function

Priority LOW 21

Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00625 Published 2022-05-04 Fixed in 9.7 CWE-200
TI-2022-09350 CVE-2022-25778 · GHSA-mx8g-4r5p-3rp5

Unload handlers may unintentionally defeat CSRF guards

Priority LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0028 Published 2022-05-04 Fixed in 9.7 CWE-352
TI-2021-11990 CVE-2021-32010 · GHSA-7xh5-p97v-cg6q

Clients may connect to a GateManager with TLS 1.0

Priority LOW 35

Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00231 Published 2022-05-04 Fixed in 9.7 CWE-326