CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43690
https://notcve.org/view.php?id=CVE-2024-43690
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE). This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior. • https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21838
https://notcve.org/view.php?id=CVE-2024-21838
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior. La neutralización inadecuada de elementos especiales en la salida (CWE-74) utilizados por la función de generación de correo electrónico de Command Centre Server podría provocar la inyección de código HTML en los correos electrónicos generados por Command Center. Este problema afecta a: Gallagher Command Center 9.00 anterior a vEL9.00.1774 (MR2), 8.90 anterior a vEL8.90.1751 (MR3), 8.80 anterior a vEL8.80.1526 (MR4), 8.70 anterior a vEL8.70.2526 (MR6), todas las versiones de 8.60 y anteriores. • https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21815
https://notcve.org/view.php?id=CVE-2024-21815
Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior. Las credenciales insuficientemente protegidas (CWE-522) para integraciones de DVR de terceros al Command Center Server son accesibles para usuarios autenticados pero sin privilegios. Este problema afecta a: Gallagher Command Center 9.00 anterior a vEL9.00.1774 (MR2), 8.90 anterior a vEL8.90.1751 (MR3), 8.80 anterior a vEL8.80.1526 (MR4), 8.70 anterior a vEL8.70.2526 (MR6), todas las versiones de 8.60 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2024-21815 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-46686
https://notcve.org/view.php?id=CVE-2023-46686
A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. This issue affects: Gallagher Diagnostics Service prior to v1.3.0 (distributed in 9.00.1507(MR1)). Un usuario privilegiado podría aprovechar la dependencia de entradas sin confianza en una decisión de seguridad para configurar el Gallagher Command Centre Diagnostics Service para utilizar protocolos de comunicación menos seguros. Este problema afecta: Gallagher Diagnostics Service anterior a v1.3.0 (distribuido en 9.00.1507(MR1)). • https://security.gallagher.com/Security-Advisories/CVE-2023-46686 • CWE-807: Reliance on Untrusted Inputs in a Security Decision •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-23584
https://notcve.org/view.php?id=CVE-2023-23584
An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable. This issue affects: Gallagher Command Centre 8.70 prior to vEL8.70.1787 (MR2), 8.60 prior to vEL8.60.2039 (MR4), all version of 8.50 and prior. Una discrepancia de respuesta observable en la API REST de Gallagher Command Centre permite a un usuario sin privilegios suficientes inferir la presencia de elementos que de otro modo no serían visibles. Este problema afecta: Gallagher Command Center 8.70 anterior a vEL8.70.1787 (MR2), 8.60 anterior a vEL8.60.2039 (MR4), todas las versiones de 8.50 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2023-23584 • CWE-203: Observable Discrepancy CWE-204: Observable Response Discrepancy •