Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-1759 (GCVE-0-2026-1759)

Vulnerability from nvd – Published: 2026-09-15 10:54 – Updated: 2026-09-15 12:20

Summary

Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 12:20 UTC

CWE

CWE-280 - Improper handling of insufficient permissions or privileges

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.5;0, 11.4.625515072:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:20:35.491540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:20:46.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "status": "affected",
              "version": "11.5;0, 11.4.625515072:0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.\u003cp\u003eThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\u003c/p\u003e\u003cp\u003eFixed in Version 11.6 or\u0026nbsp;11.4.626194074 and above\u003c/p\u003e"
            }
          ],
          "value": "Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.\n\nThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\n\n\n\nFixed in Version 11.6 or\u00a011.4.626194074 and above"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-280",
              "description": "CWE-280 Improper handling of insufficient permissions or privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T10:54:38.505Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2026-1759",
    "datePublished": "2026-09-15T10:54:38.505Z",
    "dateReserved": "2026-02-02T12:07:49.500Z",
    "dateUpdated": "2026-09-15T12:20:46.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1758 (GCVE-0-2026-1758)

Vulnerability from nvd – Published: 2026-09-15 10:51 – Updated: 2026-09-15 12:23

Title

Session Fixation

Summary

Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 12:22 UTC

CWE

CWE-384 - Session fixation

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.5;0, 11.4.625515072:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:22:57.694228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:23:59.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "status": "affected",
              "version": "11.5;0, 11.4.625515072:0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.\u003cp\u003eThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\u003c/p\u003e\u003cp\u003eFixed in Version 11.6 or\u0026nbsp;\u003cspan\u003e11.4.626194074 and above\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.\n\nThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\n\n\n\nFixed in Version 11.6 or\u00a011.4.626194074 and above"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-61",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-61 Session Fixation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384 Session fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T10:53:49.081Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Session Fixation",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2026-1758",
    "datePublished": "2026-09-15T10:51:41.022Z",
    "dateReserved": "2026-02-02T12:07:47.997Z",
    "dateUpdated": "2026-09-15T12:23:59.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14716 (GCVE-0-2025-14716)

Vulnerability from nvd – Published: 2026-03-19 10:52 – Updated: 2026-03-19 13:17

Title

Unauthorized access to information

Summary

Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-19 13:17 UTC

CWE

CWE-287 - Improper Authentication

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.4;0 , < 11.5.625504039 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14716",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T13:17:02.566290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T13:17:10.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.5.625504039",
              "status": "affected",
              "version": "11.4;0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.\u003cp\u003eThis issue affects GateManager: 11.4;0.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T10:52:30.851Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthorized access to information",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2025-14716",
    "datePublished": "2026-03-19T10:52:30.851Z",
    "dateReserved": "2025-12-15T12:39:50.601Z",
    "dateUpdated": "2026-03-19T13:17:10.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-32007 (GCVE-0-2021-32007)

Vulnerability from nvd – Published: 2024-12-13 11:05 – Updated: 2024-12-23 19:14

Title

Missing security header: Referrer-Policy URL

Summary

This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-23 19:14 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 0 , ≤ 9.5 (custom)

Credits

Regel Partners B.V.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-32007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-23T19:14:40.946759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-23T19:14:49.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThanOrEqual": "9.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Regel Partners B.V."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue affects:\u003cbr\u003eSecomea GateManager\u003cbr\u003eVersion 9.5 and all prior versions.\u003cbr\u003eProtection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers."
            }
          ],
          "value": "This issue affects:\nSecomea GateManager\nVersion 9.5 and all prior versions.\nProtection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-116",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-116 Excavation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-13T11:05:58.370Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Missing security header: Referrer-Policy URL",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2021-32007",
    "datePublished": "2024-12-13T11:05:58.370Z",
    "dateReserved": "2021-05-03T16:28:23.358Z",
    "dateUpdated": "2024-12-23T19:14:49.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1969 (GCVE-0-2024-1969)

Vulnerability from nvd – Published: 2024-04-29 13:29 – Updated: 2024-08-01 18:56

Title

Heap buffer overflow

Summary

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-29 15:12 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

2 products

Vendor	Product	Version
Secomea	GateManager	Affected: 9.7 , < 11.2.624095033 (custom)
secomea	gatemanager	Affected: 9.7 cpe:2.3:a:secomea:gatemanager:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:secomea:gatemanager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gatemanager",
            "vendor": "secomea",
            "versions": [
              {
                "status": "affected",
                "version": "9.7"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1969",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T15:12:46.757035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:05.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:56:22.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.2.624095033",
              "status": "affected",
              "version": "9.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.\u003cp\u003eThis issue affects GateManager: from 9.7 before 11.2.624095033.\u003c/p\u003e"
            }
          ],
          "value": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-29T13:29:01.094Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-6718"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Heap buffer overflow",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2024-1969",
    "datePublished": "2024-04-29T13:29:01.094Z",
    "dateReserved": "2024-02-28T14:49:31.001Z",
    "dateUpdated": "2024-08-01T18:56:22.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1579 (GCVE-0-2024-1579)

Vulnerability from nvd – Published: 2024-04-29 13:27 – Updated: 2024-08-01 18:40

Title

Insufficient seeding of random number generator

Summary

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-29 14:34 UTC

CWE

CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

2 products

Vendor	Product	Version
Secomea	GateManager	Affected: 0 , < 11.2.624071020 (custom)
secomea	gatemanager	Affected: 0 , < 11.2.62.4971020 (custom) cpe:2.3:a:secomea:gatemanager:-:::::::*

Date Public

2024-04-29 13:21

Credits

Researchers at Paderborn University and Ruhr University Bochum

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:secomea:gatemanager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gatemanager",
            "vendor": "secomea",
            "versions": [
              {
                "lessThan": "11.2.62.4971020",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1579",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T14:34:13.948903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:59:30.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:40:21.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.2.624071020",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Researchers at Paderborn University and Ruhr University Bochum"
        }
      ],
      "datePublic": "2024-04-29T13:21:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.\u003cp\u003eThis issue affects GateManager: before 11.2.624071020.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-593",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-593 Session Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-335",
              "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-29T13:27:55.045Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-6690"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Insufficient seeding of random number generator",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2024-1579",
    "datePublished": "2024-04-29T13:27:55.045Z",
    "dateReserved": "2024-02-16T12:11:01.147Z",
    "dateUpdated": "2024-08-01T18:40:21.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3675 (GCVE-0-2023-3675)

Vulnerability from nvd – Published: 2024-04-18 10:41 – Updated: 2024-08-21 14:08

Title

Insufficient input validation when downloading certain file types.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-21 14:08 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.0.623074018 , < 11.0.623373051 (custom)

Date Public

2024-04-18 10:40

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:57.508Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T14:08:31.273757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T14:08:41.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web GUI"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.0.623373051",
              "status": "affected",
              "version": "11.0.623074018",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-04-18T10:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.\u003cp\u003eThis issue affects GateManager: from 11.0.623074018 before 11.0.623373051.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-545",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-545 Pull Data from System Resources"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-18T10:41:32.348Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory"
        }
      ],
      "source": {
        "defect": [
          "RD-6533"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Insufficient input validation when downloading certain file types.",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2023-3675",
    "datePublished": "2024-04-18T10:41:25.088Z",
    "dateReserved": "2023-07-14T12:57:35.931Z",
    "dateUpdated": "2024-08-21T14:08:41.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2912 (GCVE-0-2023-2912)

Vulnerability from nvd – Published: 2023-07-17 12:31 – Updated: 2024-10-22 13:40

Title

SiteManager Embedded service disruption

Summary

Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-22 13:32 UTC

CWE

CWE-416 - Use After Free

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	SiteManager Embedded	Affected: 0 , < 11.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:03.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:57.213994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:40:14.960Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SiteManager Embedded",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction."
            }
          ],
          "value": "Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-607",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-607 Obstruction"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T12:31:05.854Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-6401"
        ],
        "discovery": "INTERNAL"
      },
      "title": "SiteManager Embedded service disruption",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2023-2912",
    "datePublished": "2023-07-17T12:31:05.854Z",
    "dateReserved": "2023-05-26T12:17:30.753Z",
    "dateUpdated": "2024-10-22T13:40:14.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0317 (GCVE-0-2023-0317)

Vulnerability from nvd – Published: 2023-04-19 11:57 – Updated: 2025-02-05 15:03

Title

GateManager debug interface is included in non-debug builds

Summary

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-05 15:02 UTC

CWE

CWE-420 - Unprotected Alternate Channel

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 10.0 , < 10.1 (custom)

Date Public

2023-04-19 11:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:10:55.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T15:02:04.508680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-420",
                "description": "CWE-420 Unprotected Alternate Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T15:03:03.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.1",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-04-19T11:57:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unprotected Alternate Channel vulnerability in debug console of  GateManager allows system administrator to obtain sensitive information."
            }
          ],
          "value": "Unprotected Alternate Channel vulnerability in debug console of  GateManager allows system administrator to obtain sensitive information."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-383",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-383 Harvesting Information via API Event Monitoring"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-420",
              "description": "CWE-420 Unprotected Alternate Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-19T11:57:46.409Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "GateManager debug interface is included in non-debug builds",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2023-0317",
    "datePublished": "2023-04-19T11:57:46.409Z",
    "dateReserved": "2023-01-16T09:36:00.479Z",
    "dateUpdated": "2025-02-05T15:03:03.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-4308 (GCVE-0-2022-4308)

Vulnerability from nvd – Published: 2023-04-19 11:56 – Updated: 2025-02-05 15:05

Title

Clear-text passwords in configuration files

Summary

Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-05 15:04 UTC

CWE

CWE-256 - Plaintext Storage of a Password

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 5.0 , < 10.1 (custom)

Date Public

2023-04-19 11:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:34:50.085Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-4308",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T15:04:01.779043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-256",
                "description": "CWE-256 Plaintext Storage of a Password",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T15:05:16.492Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "USB wizard"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-04-19T11:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked."
            }
          ],
          "value": "Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-256",
              "description": "CWE-256 Plaintext Storage of a Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-19T11:56:55.106Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Clear-text passwords in configuration files",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-4308",
    "datePublished": "2023-04-19T11:56:32.348Z",
    "dateReserved": "2022-12-06T13:33:10.501Z",
    "dateUpdated": "2025-02-05T15:05:16.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2752 (GCVE-0-2022-2752)

Vulnerability from nvd – Published: 2022-12-09 13:30 – Updated: 2025-04-22 19:44

Title

Potential vulnerabilities in GM login process

Summary

A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issue affects: Secomea GateManager versions from 9.4 through 9.7.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-22 19:44 UTC

CWE

CWE-287 - Improper Authentication

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 9.4 , < 10.0 (custom)

Date Public

2022-12-09 11:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:46:04.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T19:44:26.372042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T19:44:33.832Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.0",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-12-09T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eA vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.\u003c/div\u003e\u003cdiv\u003eThis issue affects:\u003c/div\u003e\u003cdiv\u003eSecomea GateManager versions from 9.4 through 9.7.\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.\n\nThis issue affects:\n\nSecomea GateManager versions from 9.4 through 9.7.\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-09T13:30:26.346Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory"
        }
      ],
      "source": {
        "defect": [
          "RD-5896"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Potential vulnerabilities in GM login process",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-2752",
    "datePublished": "2022-12-09T13:30:26.346Z",
    "dateReserved": "2022-08-10T09:43:33.129Z",
    "dateUpdated": "2025-04-22T19:44:33.832Z",
    "requesterUserId": "44bd1e71-3702-434c-b36b-c1ac3bb0bab6",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-38123 (GCVE-0-2022-38123)

Vulnerability from nvd – Published: 2022-12-06 15:58 – Updated: 2025-04-23 16:12

Title

Insufficient validation of plugin files

Summary

Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 16:12 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 0 , < 10.0 ("custom")

Date Public

2022-12-05 23:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:45:52.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-38123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T16:12:26.690794Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:12:37.744Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.0",
              "status": "affected",
              "version": "0",
              "versionType": "\"custom\""
            }
          ]
        }
      ],
      "datePublic": "2022-12-05T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\u003c/div\u003e\u003cdiv\u003eThis issue affects:\u003c/div\u003e\u003cdiv\u003eSecomea GateManager\u003c/div\u003e\u003cdiv\u003eversions prior to 10.0.\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\n\nThis issue affects:\n\nSecomea GateManager\n\nversions prior to 10.0.\n\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-06T15:59:52.408Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-5851"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Insufficient validation of plugin files",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-38123",
    "datePublished": "2022-12-06T15:58:01.365Z",
    "dateReserved": "2022-08-10T09:46:05.632Z",
    "dateUpdated": "2025-04-23T16:12:37.744Z",
    "requesterUserId": "44bd1e71-3702-434c-b36b-c1ac3bb0bab6",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-25786 (GCVE-0-2022-25786)

Vulnerability from nvd – Published: 2022-05-04 17:17 – Updated: 2024-08-03 04:49

Title

GateManager debug interface is included in production builds

Summary

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-420 - Unprotected Alternate Channel

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: all , < 9.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:49:43.267Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "9.7",
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-420",
              "description": "CWE-420 Unprotected Alternate Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-04T17:17:34.000Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-5457"
        ],
        "discovery": "INTERNAL"
      },
      "title": "GateManager debug interface is included in production builds",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "VulnerabilityReporting@secomea.com",
          "ID": "CVE-2022-25786",
          "STATE": "PUBLIC",
          "TITLE": "GateManager debug interface is included in production builds"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GateManager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "all",
                            "version_value": "9.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secomea"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-420 Unprotected Alternate Channel"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.secomea.com/support/cybersecurity-advisory/",
              "refsource": "MISC",
              "url": "https://www.secomea.com/support/cybersecurity-advisory/"
            }
          ]
        },
        "source": {
          "defect": [
            "RD-5457"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-25786",
    "datePublished": "2022-05-04T17:17:34.000Z",
    "dateReserved": "2022-02-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T04:49:43.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-32009 (GCVE-0-2021-32009)

Vulnerability from nvd – Published: 2022-03-11 17:53 – Updated: 2024-08-03 23:17

Title

Missing XSS guards on firmware page

Summary

Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: All , ≤ 9.6.621421014 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:17:28.154Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThanOrEqual": "9.6.621421014",
              "status": "affected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-11T17:53:58.000Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secomea.com/support/cybersecurity-advisory"
        }
      ],
      "source": {
        "defect": [
          "RD-5196"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Missing XSS guards on firmware page",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "VulnerabilityReporting@secomea.com",
          "ID": "CVE-2021-32009",
          "STATE": "PUBLIC",
          "TITLE": "Missing XSS guards on firmware page"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GateManager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "All",
                            "version_value": "9.6.621421014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secomea"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.secomea.com/support/cybersecurity-advisory",
              "refsource": "MISC",
              "url": "https://www.secomea.com/support/cybersecurity-advisory"
            }
          ]
        },
        "source": {
          "defect": [
            "RD-5196"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2021-32009",
    "datePublished": "2022-03-11T17:53:58.000Z",
    "dateReserved": "2021-05-03T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:17:28.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-32006 (GCVE-0-2021-32006)

Vulnerability from nvd – Published: 2022-03-07 15:08 – Updated: 2024-08-03 23:17

Title

GateManager information leak for LinkManager Users

Summary

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-275 - Permission Issues
CWE-274 - Improper Handling of Insufficient Privileges

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: All , ≤ 9.6.621421014 (custom)

Credits

Schlumberger

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:17:28.226Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThanOrEqual": "9.6.621421014",
              "status": "affected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Schlumberger"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-275",
              "description": "CWE-275 Permission Issues",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-274",
              "description": "CWE-274 Improper Handling of Insufficient Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-07T15:08:16.000Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-5018"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "GateManager information leak for LinkManager Users",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "VulnerabilityReporting@secomea.com",
          "ID": "CVE-2021-32006",
          "STATE": "PUBLIC",
          "TITLE": "GateManager information leak for LinkManager Users"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GateManager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "All",
                            "version_value": "9.6.621421014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secomea"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Schlumberger"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-275 Permission Issues"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-274 Improper Handling of Insufficient Privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.secomea.com/support/cybersecurity-advisory/",
              "refsource": "MISC",
              "url": "https://www.secomea.com/support/cybersecurity-advisory/"
            }
          ]
        },
        "source": {
          "defect": [
            "RD-5018"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2021-32006",
    "datePublished": "2022-03-07T15:08:16.000Z",
    "dateReserved": "2021-05-03T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:17:28.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-1759 (GCVE-0-2026-1759)

Vulnerability from cvelistv5 – Published: 2026-09-15 10:54 – Updated: 2026-09-15 12:20

Summary

Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 12:20 UTC

CWE

CWE-280 - Improper handling of insufficient permissions or privileges

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.5;0, 11.4.625515072:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:20:35.491540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:20:46.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "status": "affected",
              "version": "11.5;0, 11.4.625515072:0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.\u003cp\u003eThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\u003c/p\u003e\u003cp\u003eFixed in Version 11.6 or\u0026nbsp;11.4.626194074 and above\u003c/p\u003e"
            }
          ],
          "value": "Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.\n\nThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\n\n\n\nFixed in Version 11.6 or\u00a011.4.626194074 and above"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-280",
              "description": "CWE-280 Improper handling of insufficient permissions or privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T10:54:38.505Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2026-1759",
    "datePublished": "2026-09-15T10:54:38.505Z",
    "dateReserved": "2026-02-02T12:07:49.500Z",
    "dateUpdated": "2026-09-15T12:20:46.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1758 (GCVE-0-2026-1758)

Vulnerability from cvelistv5 – Published: 2026-09-15 10:51 – Updated: 2026-09-15 12:23

Title

Session Fixation

Summary

Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 12:22 UTC

CWE

CWE-384 - Session fixation

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.5;0, 11.4.625515072:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:22:57.694228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:23:59.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "status": "affected",
              "version": "11.5;0, 11.4.625515072:0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.\u003cp\u003eThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\u003c/p\u003e\u003cp\u003eFixed in Version 11.6 or\u0026nbsp;\u003cspan\u003e11.4.626194074 and above\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.\n\nThis issue affects GateManager: 11.5;0, 11.4.625515072:0.\n\n\n\nFixed in Version 11.6 or\u00a011.4.626194074 and above"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-61",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-61 Session Fixation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384 Session fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T10:53:49.081Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Session Fixation",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2026-1758",
    "datePublished": "2026-09-15T10:51:41.022Z",
    "dateReserved": "2026-02-02T12:07:47.997Z",
    "dateUpdated": "2026-09-15T12:23:59.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14716 (GCVE-0-2025-14716)

Vulnerability from cvelistv5 – Published: 2026-03-19 10:52 – Updated: 2026-03-19 13:17

Title

Unauthorized access to information

Summary

Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-19 13:17 UTC

CWE

CWE-287 - Improper Authentication

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.4;0 , < 11.5.625504039 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14716",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T13:17:02.566290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T13:17:10.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.5.625504039",
              "status": "affected",
              "version": "11.4;0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.\u003cp\u003eThis issue affects GateManager: 11.4;0.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T10:52:30.851Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthorized access to information",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2025-14716",
    "datePublished": "2026-03-19T10:52:30.851Z",
    "dateReserved": "2025-12-15T12:39:50.601Z",
    "dateUpdated": "2026-03-19T13:17:10.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-32007 (GCVE-0-2021-32007)

Vulnerability from cvelistv5 – Published: 2024-12-13 11:05 – Updated: 2024-12-23 19:14

Title

Missing security header: Referrer-Policy URL

Summary

This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-23 19:14 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 0 , ≤ 9.5 (custom)

Credits

Regel Partners B.V.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-32007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-23T19:14:40.946759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-23T19:14:49.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThanOrEqual": "9.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Regel Partners B.V."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue affects:\u003cbr\u003eSecomea GateManager\u003cbr\u003eVersion 9.5 and all prior versions.\u003cbr\u003eProtection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers."
            }
          ],
          "value": "This issue affects:\nSecomea GateManager\nVersion 9.5 and all prior versions.\nProtection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-116",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-116 Excavation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-13T11:05:58.370Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Missing security header: Referrer-Policy URL",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2021-32007",
    "datePublished": "2024-12-13T11:05:58.370Z",
    "dateReserved": "2021-05-03T16:28:23.358Z",
    "dateUpdated": "2024-12-23T19:14:49.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1969 (GCVE-0-2024-1969)

Vulnerability from cvelistv5 – Published: 2024-04-29 13:29 – Updated: 2024-08-01 18:56

Title

Heap buffer overflow

Summary

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-29 15:12 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

2 products

Vendor	Product	Version
Secomea	GateManager	Affected: 9.7 , < 11.2.624095033 (custom)
secomea	gatemanager	Affected: 9.7 cpe:2.3:a:secomea:gatemanager:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:secomea:gatemanager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gatemanager",
            "vendor": "secomea",
            "versions": [
              {
                "status": "affected",
                "version": "9.7"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1969",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T15:12:46.757035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:05.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:56:22.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.2.624095033",
              "status": "affected",
              "version": "9.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.\u003cp\u003eThis issue affects GateManager: from 9.7 before 11.2.624095033.\u003c/p\u003e"
            }
          ],
          "value": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-29T13:29:01.094Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-6718"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Heap buffer overflow",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2024-1969",
    "datePublished": "2024-04-29T13:29:01.094Z",
    "dateReserved": "2024-02-28T14:49:31.001Z",
    "dateUpdated": "2024-08-01T18:56:22.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1579 (GCVE-0-2024-1579)

Vulnerability from cvelistv5 – Published: 2024-04-29 13:27 – Updated: 2024-08-01 18:40

Title

Insufficient seeding of random number generator

Summary

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-29 14:34 UTC

CWE

CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

2 products

Vendor	Product	Version
Secomea	GateManager	Affected: 0 , < 11.2.624071020 (custom)
secomea	gatemanager	Affected: 0 , < 11.2.62.4971020 (custom) cpe:2.3:a:secomea:gatemanager:-:::::::*

Date Public

2024-04-29 13:21

Credits

Researchers at Paderborn University and Ruhr University Bochum

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:secomea:gatemanager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gatemanager",
            "vendor": "secomea",
            "versions": [
              {
                "lessThan": "11.2.62.4971020",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1579",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T14:34:13.948903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:59:30.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:40:21.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Webserver"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.2.624071020",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Researchers at Paderborn University and Ruhr University Bochum"
        }
      ],
      "datePublic": "2024-04-29T13:21:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.\u003cp\u003eThis issue affects GateManager: before 11.2.624071020.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-593",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-593 Session Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-335",
              "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-29T13:27:55.045Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-6690"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Insufficient seeding of random number generator",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2024-1579",
    "datePublished": "2024-04-29T13:27:55.045Z",
    "dateReserved": "2024-02-16T12:11:01.147Z",
    "dateUpdated": "2024-08-01T18:40:21.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3675 (GCVE-0-2023-3675)

Vulnerability from cvelistv5 – Published: 2024-04-18 10:41 – Updated: 2024-08-21 14:08

Title

Insufficient input validation when downloading certain file types.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-21 14:08 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 11.0.623074018 , < 11.0.623373051 (custom)

Date Public

2024-04-18 10:40

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:57.508Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T14:08:31.273757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T14:08:41.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web GUI"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.0.623373051",
              "status": "affected",
              "version": "11.0.623074018",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-04-18T10:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.\u003cp\u003eThis issue affects GateManager: from 11.0.623074018 before 11.0.623373051.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-545",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-545 Pull Data from System Resources"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-18T10:41:32.348Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory"
        }
      ],
      "source": {
        "defect": [
          "RD-6533"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Insufficient input validation when downloading certain file types.",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2023-3675",
    "datePublished": "2024-04-18T10:41:25.088Z",
    "dateReserved": "2023-07-14T12:57:35.931Z",
    "dateUpdated": "2024-08-21T14:08:41.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2912 (GCVE-0-2023-2912)

Vulnerability from cvelistv5 – Published: 2023-07-17 12:31 – Updated: 2024-10-22 13:40

Title

SiteManager Embedded service disruption

Summary

Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-22 13:32 UTC

CWE

CWE-416 - Use After Free

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	SiteManager Embedded	Affected: 0 , < 11.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:03.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:57.213994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:40:14.960Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SiteManager Embedded",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "11.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction."
            }
          ],
          "value": "Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-607",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-607 Obstruction"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T12:31:05.854Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-6401"
        ],
        "discovery": "INTERNAL"
      },
      "title": "SiteManager Embedded service disruption",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2023-2912",
    "datePublished": "2023-07-17T12:31:05.854Z",
    "dateReserved": "2023-05-26T12:17:30.753Z",
    "dateUpdated": "2024-10-22T13:40:14.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0317 (GCVE-0-2023-0317)

Vulnerability from cvelistv5 – Published: 2023-04-19 11:57 – Updated: 2025-02-05 15:03

Title

GateManager debug interface is included in non-debug builds

Summary

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-05 15:02 UTC

CWE

CWE-420 - Unprotected Alternate Channel

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 10.0 , < 10.1 (custom)

Date Public

2023-04-19 11:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:10:55.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T15:02:04.508680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-420",
                "description": "CWE-420 Unprotected Alternate Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T15:03:03.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.1",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-04-19T11:57:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unprotected Alternate Channel vulnerability in debug console of  GateManager allows system administrator to obtain sensitive information."
            }
          ],
          "value": "Unprotected Alternate Channel vulnerability in debug console of  GateManager allows system administrator to obtain sensitive information."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-383",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-383 Harvesting Information via API Event Monitoring"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-420",
              "description": "CWE-420 Unprotected Alternate Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-19T11:57:46.409Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "GateManager debug interface is included in non-debug builds",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2023-0317",
    "datePublished": "2023-04-19T11:57:46.409Z",
    "dateReserved": "2023-01-16T09:36:00.479Z",
    "dateUpdated": "2025-02-05T15:03:03.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-4308 (GCVE-0-2022-4308)

Vulnerability from cvelistv5 – Published: 2023-04-19 11:56 – Updated: 2025-02-05 15:05

Title

Clear-text passwords in configuration files

Summary

Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-05 15:04 UTC

CWE

CWE-256 - Plaintext Storage of a Password

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 5.0 , < 10.1 (custom)

Date Public

2023-04-19 11:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:34:50.085Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-4308",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T15:04:01.779043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-256",
                "description": "CWE-256 Plaintext Storage of a Password",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T15:05:16.492Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "USB wizard"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-04-19T11:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked."
            }
          ],
          "value": "Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-256",
              "description": "CWE-256 Plaintext Storage of a Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-19T11:56:55.106Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Clear-text passwords in configuration files",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-4308",
    "datePublished": "2023-04-19T11:56:32.348Z",
    "dateReserved": "2022-12-06T13:33:10.501Z",
    "dateUpdated": "2025-02-05T15:05:16.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2752 (GCVE-0-2022-2752)

Vulnerability from cvelistv5 – Published: 2022-12-09 13:30 – Updated: 2025-04-22 19:44

Title

Potential vulnerabilities in GM login process

Summary

A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issue affects: Secomea GateManager versions from 9.4 through 9.7.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-22 19:44 UTC

CWE

CWE-287 - Improper Authentication

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 9.4 , < 10.0 (custom)

Date Public

2022-12-09 11:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:46:04.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T19:44:26.372042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T19:44:33.832Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.0",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-12-09T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eA vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.\u003c/div\u003e\u003cdiv\u003eThis issue affects:\u003c/div\u003e\u003cdiv\u003eSecomea GateManager versions from 9.4 through 9.7.\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.\n\nThis issue affects:\n\nSecomea GateManager versions from 9.4 through 9.7.\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-09T13:30:26.346Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory"
        }
      ],
      "source": {
        "defect": [
          "RD-5896"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Potential vulnerabilities in GM login process",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-2752",
    "datePublished": "2022-12-09T13:30:26.346Z",
    "dateReserved": "2022-08-10T09:43:33.129Z",
    "dateUpdated": "2025-04-22T19:44:33.832Z",
    "requesterUserId": "44bd1e71-3702-434c-b36b-c1ac3bb0bab6",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-38123 (GCVE-0-2022-38123)

Vulnerability from cvelistv5 – Published: 2022-12-06 15:58 – Updated: 2025-04-23 16:12

Title

Insufficient validation of plugin files

Summary

Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 16:12 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: 0 , < 10.0 ("custom")

Date Public

2022-12-05 23:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:45:52.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-38123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T16:12:26.690794Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:12:37.744Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "10.0",
              "status": "affected",
              "version": "0",
              "versionType": "\"custom\""
            }
          ]
        }
      ],
      "datePublic": "2022-12-05T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\u003c/div\u003e\u003cdiv\u003eThis issue affects:\u003c/div\u003e\u003cdiv\u003eSecomea GateManager\u003c/div\u003e\u003cdiv\u003eversions prior to 10.0.\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\n\nThis issue affects:\n\nSecomea GateManager\n\nversions prior to 10.0.\n\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-06T15:59:52.408Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-5851"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Insufficient validation of plugin files",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-38123",
    "datePublished": "2022-12-06T15:58:01.365Z",
    "dateReserved": "2022-08-10T09:46:05.632Z",
    "dateUpdated": "2025-04-23T16:12:37.744Z",
    "requesterUserId": "44bd1e71-3702-434c-b36b-c1ac3bb0bab6",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-25786 (GCVE-0-2022-25786)

Vulnerability from cvelistv5 – Published: 2022-05-04 17:17 – Updated: 2024-08-03 04:49

Title

GateManager debug interface is included in production builds

Summary

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-420 - Unprotected Alternate Channel

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: all , < 9.7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:49:43.267Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThan": "9.7",
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-420",
              "description": "CWE-420 Unprotected Alternate Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-04T17:17:34.000Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-5457"
        ],
        "discovery": "INTERNAL"
      },
      "title": "GateManager debug interface is included in production builds",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "VulnerabilityReporting@secomea.com",
          "ID": "CVE-2022-25786",
          "STATE": "PUBLIC",
          "TITLE": "GateManager debug interface is included in production builds"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GateManager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "all",
                            "version_value": "9.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secomea"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-420 Unprotected Alternate Channel"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.secomea.com/support/cybersecurity-advisory/",
              "refsource": "MISC",
              "url": "https://www.secomea.com/support/cybersecurity-advisory/"
            }
          ]
        },
        "source": {
          "defect": [
            "RD-5457"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2022-25786",
    "datePublished": "2022-05-04T17:17:34.000Z",
    "dateReserved": "2022-02-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T04:49:43.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-32009 (GCVE-0-2021-32009)

Vulnerability from cvelistv5 – Published: 2022-03-11 17:53 – Updated: 2024-08-03 23:17

Title

Missing XSS guards on firmware page

Summary

Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: All , ≤ 9.6.621421014 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:17:28.154Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThanOrEqual": "9.6.621421014",
              "status": "affected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-11T17:53:58.000Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secomea.com/support/cybersecurity-advisory"
        }
      ],
      "source": {
        "defect": [
          "RD-5196"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Missing XSS guards on firmware page",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "VulnerabilityReporting@secomea.com",
          "ID": "CVE-2021-32009",
          "STATE": "PUBLIC",
          "TITLE": "Missing XSS guards on firmware page"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GateManager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "All",
                            "version_value": "9.6.621421014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secomea"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.secomea.com/support/cybersecurity-advisory",
              "refsource": "MISC",
              "url": "https://www.secomea.com/support/cybersecurity-advisory"
            }
          ]
        },
        "source": {
          "defect": [
            "RD-5196"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2021-32009",
    "datePublished": "2022-03-11T17:53:58.000Z",
    "dateReserved": "2021-05-03T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:17:28.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-32006 (GCVE-0-2021-32006)

Vulnerability from cvelistv5 – Published: 2022-03-07 15:08 – Updated: 2024-08-03 23:17

Title

GateManager information leak for LinkManager Users

Summary

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-275 - Permission Issues
CWE-274 - Improper Handling of Insufficient Privileges

Assigner

Secomea icscert root Scorecard

References

1 reference

URL	Tags
https://www.secomea.com/support/cybersecurity-advisory/	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Secomea	GateManager	Affected: All , ≤ 9.6.621421014 (custom)

Credits

Schlumberger

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:17:28.226Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.secomea.com/support/cybersecurity-advisory/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GateManager",
          "vendor": "Secomea",
          "versions": [
            {
              "lessThanOrEqual": "9.6.621421014",
              "status": "affected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Schlumberger"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-275",
              "description": "CWE-275 Permission Issues",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-274",
              "description": "CWE-274 Improper Handling of Insufficient Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-07T15:08:16.000Z",
        "orgId": "f2815942-3388-4c08-ba09-6c15850fda90",
        "shortName": "Secomea"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secomea.com/support/cybersecurity-advisory/"
        }
      ],
      "source": {
        "defect": [
          "RD-5018"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "GateManager information leak for LinkManager Users",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "VulnerabilityReporting@secomea.com",
          "ID": "CVE-2021-32006",
          "STATE": "PUBLIC",
          "TITLE": "GateManager information leak for LinkManager Users"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GateManager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "All",
                            "version_value": "9.6.621421014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secomea"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Schlumberger"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-275 Permission Issues"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-274 Improper Handling of Insufficient Privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.secomea.com/support/cybersecurity-advisory/",
              "refsource": "MISC",
              "url": "https://www.secomea.com/support/cybersecurity-advisory/"
            }
          ]
        },
        "source": {
          "defect": [
            "RD-5018"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90",
    "assignerShortName": "Secomea",
    "cveId": "CVE-2021-32006",
    "datePublished": "2022-03-07T15:08:16.000Z",
    "dateReserved": "2021-05-03T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:17:28.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

40 vulnerabilities by secomea

CVE-2026-1759 (GCVE-0-2026-1759)

CVE-2026-1758 (GCVE-0-2026-1758)

CVE-2025-14716 (GCVE-0-2025-14716)

CVE-2021-32007 (GCVE-0-2021-32007)

CVE-2024-1969 (GCVE-0-2024-1969)

CVE-2024-1579 (GCVE-0-2024-1579)

CVE-2023-3675 (GCVE-0-2023-3675)

CVE-2023-2912 (GCVE-0-2023-2912)

CVE-2023-0317 (GCVE-0-2023-0317)

CVE-2022-4308 (GCVE-0-2022-4308)

CVE-2022-2752 (GCVE-0-2022-2752)

CVE-2022-38123 (GCVE-0-2022-38123)

CVE-2022-25786 (GCVE-0-2022-25786)

CVE-2021-32009 (GCVE-0-2021-32009)

CVE-2021-32006 (GCVE-0-2021-32006)

CVE-2026-1759 (GCVE-0-2026-1759)

CVE-2026-1758 (GCVE-0-2026-1758)

CVE-2025-14716 (GCVE-0-2025-14716)

CVE-2021-32007 (GCVE-0-2021-32007)

CVE-2024-1969 (GCVE-0-2024-1969)

CVE-2024-1579 (GCVE-0-2024-1579)

CVE-2023-3675 (GCVE-0-2023-3675)

CVE-2023-2912 (GCVE-0-2023-2912)

CVE-2023-0317 (GCVE-0-2023-0317)

CVE-2022-4308 (GCVE-0-2022-4308)

CVE-2022-2752 (GCVE-0-2022-2752)

CVE-2022-38123 (GCVE-0-2022-38123)

CVE-2022-25786 (GCVE-0-2022-25786)

CVE-2021-32009 (GCVE-0-2021-32009)

CVE-2021-32006 (GCVE-0-2021-32006)