Secomea GateManager 9250 any version

A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c.

Unload handlers may unintentionally defeat CSRF guards

Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation

Clients may connect to a GateManager with TLS 1.0

GTA URLs issued by LMM WEB API may leak information

Reflected XSS issues in GateManager

Insufficient privilege checks on object access and updates.

Host Header Injection allowing web cache poisoning attacks

Missing HtppOnly and Secure flags

CSV Formula Injection possible due to improper fields escaping in GateManager

Scripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS)

Information leak via device availability query function

Hacking attempts from logged-in users are not properly logged by GM

Insufficient scope checks allows adding unrelated audit log entries