5 results (0.003 seconds)

CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2023-23576

https://notcve.org/view.php?id=CVE-2023-23576

Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior. El orden de comportamiento incorrecto en Command Center Server podría permitir que los usuarios privilegiados obtengan acceso físico al sitio durante más tiempo del previsto después de una interrupción de la red cuando se utilizan competencias en la decisión de acceso. Este problema afecta a: Gallagher Command Center: 8.90 anterior a vEL8.90.1620 (MR2), 8.80 anterior a vEL8.80.1369 (MR3), 8.70 anterior a vEL8.70.2375 (MR5), 8.60 anterior a vEL8.60.2550 (MR7), todas las versiones de 8.50 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2023-23576 • CWE-696: Incorrect Behavior Order •

CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-23570

https://notcve.org/view.php?id=CVE-2023-23570

Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all versions of 8.80 and prior. La aplicación de seguridad del lado del servidor para el servidor Command Center por parte del cliente podría omitirse y dar lugar a una configuración no válida con un comportamiento indefinido. Este problema afecta: Gallagher Command Center 8.90 anterior a vEL8.90.1620 (MR2), todas las versiones 8.80 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2023-23570 • CWE-602: Client-Side Enforcement of Server-Side Security •

CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0

CVE-2023-22439

https://notcve.org/view.php?id=CVE-2023-22439

Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior. Se puede utilizar una validación de entrada incorrecta de una solicitud HTTP grande en la interfaz web de diagnóstico opcional de Controller 6000 y Controller 7000 (puerto 80) para realizar una denegación de servicio de la interfaz web de diagnóstico. Este problema afecta a: Gallagher Controller 6000 y 7000 8.90 antes de vCR8.90.231204a (distribuido en 8.90.1620 (MR2)), 8.80 antes de vCR8.80.231204a (distribuido en 8.80.1369 (MR3)), 8.70 antes de vCR8. 70.231204a (distribuido en 8.70.2375 (MR5)), 8.60 antes de vCR8.60.231116a (distribuido en 8.60.2550 (MR7)), todas las versiones de 8.50 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2023-22439 • CWE-20: Improper Input Validation •

CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-23568

https://notcve.org/view.php?id=CVE-2023-23568

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affects Command Centre: vEL 8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior • https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-23568 • CWE-285: Improper Authorization •

CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-25074 – Competency access levels not enforced in the server

https://notcve.org/view.php?id=CVE-2023-25074

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior. • https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074 • CWE-285: Improper Authorization •