Secomea vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-1758 Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.High 8.3 · Sep 15, 2026
• CVE-2024-1969 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.ThisHigh 8.2 · Apr 29, 2024
• CVE-2024-1579 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue aHigh 8.1 · Apr 29, 2024
• CVE-2022-38123 Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager inHigh 8.7 · Dec 6, 2022
• CVE-2022-25787 Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection.High 7.5 · May 4, 2022
• CVE-2022-25784 Cross-site Scripting (XSS) vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting.Critical 9.1 · May 4, 2022
• CVE-2021-32008 This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions.Critical 9.9 · Mar 4, 2022
• CVE-2021-32003 Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used afterHigh 8 · Aug 5, 2021
• CVE-2020-29030 Cross-Site Request Forgery (CSRF) vulnerability in web GUI of Secomea GateManager allows an attacker to execute malicious code.High 8.1 · Mar 5, 2021
• CVE-2020-29029 Improper Input Validation, Cross-site Scripting (XSS) vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code.High 7.3 · Mar 5, 2021
• CVE-2020-29020 Improper Access Control vulnerability in web service of Secomea SiteManager allows remote attacker to access the web UI from the internet using the configured cCritical 9.1 · Mar 5, 2021
• CVE-2020-29032 Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated attacker to execute malicious code on serveHigh 8.4 · Mar 5, 2021
• CVE-2020-29031 An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any usHigh 7.1 · Feb 15, 2021
• CVE-2020-29026 A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions Critical 9 · Feb 15, 2021
• CVE-2020-14512 GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.High 8.1 · Aug 25, 2020
• CVE-2020-14510 GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as rCritical 9.8 · Aug 25, 2020
• CVE-2020-14508 GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code orHigh 8.1 · Aug 25, 2020