CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-29028 – Reflected XSS issues
https://notcve.org/view.php?id=CVE-2020-29028
Cross-site Scripting (XSS) vulnerability in web GUI of Secomea GateManager allows an attacker to inject arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en la GUI web de Secomea GateManager, permite a un atacante inyectar código javascript arbitrario. Este problema afecta a: Secomea GateManager todas las versiones anteriores a 9.4 • https://www.secomea.com/support/cybersecurity-advisory • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-29029 – XSS issue due to insufficient sanitization of input field
https://notcve.org/view.php?id=CVE-2020-29029
Improper Input Validation, Cross-site Scripting (XSS) vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4. Una vulnerabilidad de Comprobación Inapropiada de la Entrada y de tipo Cross-site Scripting (XSS) en la GUI web de Secomea GateManager, permite a un atacante ejecutar código javascript arbitrario. Este problema afecta a: Secomea GateManager todas las versiones anteriores a 9.4 • https://www.secomea.com/support/cybersecurity-advisory • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-29032 – Add integrity check of GateManager firmware
https://notcve.org/view.php?id=CVE-2020-29032
Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated attacker to execute malicious code on server. This issue affects: Secomea GateManager all versions prior to 9.4.621054022 Una vulnerabilidad de Carga de Código Sin Comprobación de integridad en el archivo de firmware de Secomea GateManager, permite a un atacante autenticado ejecutar código malicioso en el servidor. Este problema afecta a: Secomea GateManager todas las versiones anteriores a 9.4.621054022 • https://www.secomea.com/support/cybersecurity-advisory/#3737 https://www.tenable.com/security/research/tra-2021-06 • CWE-434: Unrestricted Upload of File with Dangerous Type CWE-494: Download of Code Without Integrity Check •
CVSS: 5.4EPSS: 0%CPEs: 18EXPL: 0CVE-2020-29027 – Reflected Cross Site Scripting
https://notcve.org/view.php?id=CVE-2020-29027
Cross-site Scripting (XSS) vulnerability in GUI of Secomea SiteManager could allow an attacker to cause an XSS Attack. This issue affects: Secomea SiteManager all versions prior to 9.3. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en la GUI de Secomea SiteManager, podría permitir a un atacante causar un ataque de tipo XSS. Este problema afecta: Secomea SiteManager todas las versiones anteriores a 9.3 • https://www.secomea.com/support/cybersecurity-advisory/#3042 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-29025 – DOM-based Javascript injection
https://notcve.org/view.php?id=CVE-2020-29025
A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3 Una vulnerabilidad en el servidor Web de SiteManager-Embedded (SM-E), que puede permitir al atacante construir una URL que, si es visitada por otro usuario de la aplicación, causará que el código JavaScript suministrado por el atacante se ejecute dentro del navegador del usuario en el contexto de la sesión de ese usuario con la aplicación. Este problema afecta a todas las versiones y variantes de SM-E anteriores a versión 9.3 • https://www.secomea.com/support/cybersecurity-advisory/#3042 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •