Secomea GatemManager 8250 any version

OFF-BY-ONE ERROR CWE-193

IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158

OFF-BY-ONE ERROR CWE-193

A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c.

Unload handlers may unintentionally defeat CSRF guards

Add integrity check of GateManager firmware

USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916

Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation

Clients may connect to a GateManager with TLS 1.0

GTA URLs issued by LMM WEB API may leak information

Reflected XSS issues in GateManager

Insufficient privilege checks on object access and updates.

Host Header Injection allowing web cache poisoning attacks

GateManager does not enforce strict hostname matching for WEB server

Missing HtppOnly and Secure flags

CSV Formula Injection possible due to improper fields escaping in GateManager

Scripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS)

Information leak via device availability query function

Hacking attempts from logged-in users are not properly logged by GM

Insufficient scope checks allows adding unrelated audit log entries