# Secomea GateManager.

Every CVE that names Secomea GateManager among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Secomea GateManager: Improper handling of insufficient permissions or privileges vulnerability in Secomea…](https://agentprime.io/advisories/CVE-2026-1759.md)
  `CVE-2026-1759` · CVE record: Secomea GateManager · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-280
- [Session Fixation](https://agentprime.io/advisories/CVE-2026-1758.md)
  `CVE-2026-1758` · CVE record: Secomea GateManager · CVSS 8.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Unauthorized access to information](https://agentprime.io/advisories/CVE-2025-14716.md)
  `CVE-2025-14716` · CVE record: Secomea GateManager · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Authentication bypass
- [Missing security header: Referrer-Policy URL](https://agentprime.io/advisories/CVE-2021-32007.md)
  `CVE-2021-32007` · CVE record: Secomea GateManager · CVSS 3.5 Low · Not analysed yet · Published 13 Dec 2024 · Tags: Information disclosure
- [Heap buffer overflow](https://agentprime.io/advisories/CVE-2024-1969.md)
  `CVE-2024-1969` · CVE record: Secomea GateManager · CVSS 8.2 High · Not analysed yet · Published 29 Apr 2024 · Tags: Memory corruption
- [Insufficient seeding of random number generator](https://agentprime.io/advisories/CVE-2024-1579.md)
  `CVE-2024-1579` · CVE record: Secomea GateManager · CVSS 8.1 High · Not analysed yet · Published 29 Apr 2024 · Tags: CWE-335
- [Insufficient input validation when downloading certain file types.](https://agentprime.io/advisories/CVE-2023-3675.md)
  `CVE-2023-3675` · CVE record: Secomea GateManager · CVSS 6.5 Medium · Not analysed yet · Published 18 Apr 2024 · Tags: Path traversal
- [GateManager debug interface is included in non-debug builds](https://agentprime.io/advisories/CVE-2023-0317.md)
  `CVE-2023-0317` · CVE record: Secomea GateManager · CVSS 4.9 Medium · Not analysed yet · Published 19 Apr 2023 · Tags: CWE-420
- [Clear-text passwords in configuration files](https://agentprime.io/advisories/CVE-2022-4308.md)
  `CVE-2022-4308` · CVE record: Secomea GateManager · CVSS 6.1 Medium · Not analysed yet · Published 19 Apr 2023 · Tags: CWE-256
- [Potential vulnerabilities in GM login process](https://agentprime.io/advisories/CVE-2022-2752.md)
  `CVE-2022-2752` · CVE record: Secomea GateManager · CVSS 5.5 Medium · Not analysed yet · Published 9 Dec 2022 · Tags: Authentication bypass
- [Insufficient validation of plugin files](https://agentprime.io/advisories/CVE-2022-38123.md)
  `CVE-2022-38123` · CVE record: Secomea GateManager · CVSS 8.7 High · Not analysed yet · Published 6 Dec 2022 · Tags: CWE-20
- [GateManager debug interface is included in production builds](https://agentprime.io/advisories/CVE-2022-25786.md)
  `CVE-2022-25786` · CVE record: Secomea GateManager · CVSS 4.9 Medium · Not analysed yet · Published 4 May 2022 · Tags: CWE-420
- [GTA URLs issued by LMM WEB API may leak information](https://agentprime.io/advisories/CVE-2022-25787.md)
  `CVE-2022-25787` · CVE record: Secomea GateManager · CVSS 7.5 High · Not analysed yet · Published 4 May 2022 · Tags: CWE-598
- [Hacking attempts from logged-in users are not properly logged by GM](https://agentprime.io/advisories/CVE-2022-25783.md)
  `CVE-2022-25783` · CVE record: Secomea GateManager · CVSS 4.3 Medium · Not analysed yet · Published 4 May 2022 · Tags: CWE-778
- [Insufficient privilege checks on object access and updates.](https://agentprime.io/advisories/CVE-2022-25782.md)
  `CVE-2022-25782` · CVE record: Secomea GateManager · CVSS 5.4 Medium · Not analysed yet · Published 4 May 2022 · Tags: CWE-274
- [Reflected XSS issues in GateManager](https://agentprime.io/advisories/CVE-2022-25781.md)
  `CVE-2022-25781` · CVE record: Secomea GateManager · CVSS 4.2 Medium · Not analysed yet · Published 4 May 2022 · Tags: Cross-site scripting (XSS)
- [Information leak via device availability query function](https://agentprime.io/advisories/CVE-2022-25780.md)
  `CVE-2022-25780` · CVE record: Secomea GateManager · CVSS 4.3 Medium · Not analysed yet · Published 4 May 2022 · Tags: Information disclosure
- [Insufficient scope checks allows adding unrelated audit log entries](https://agentprime.io/advisories/CVE-2022-25779.md)
  `CVE-2022-25779` · CVE record: Secomea GateManager · CVSS 4.3 Medium · Not analysed yet · Published 4 May 2022 · Tags: CWE-779
- [Unload handlers may unintentionally defeat CSRF guards](https://agentprime.io/advisories/CVE-2022-25778.md)
  `CVE-2022-25778` · CVE record: Secomea GateManager · CVSS 4.2 Medium · Not analysed yet · Published 4 May 2022 · Tags: Cross-site request forgery (CSRF)
- [Clients may connect to a GateManager with TLS 1.0](https://agentprime.io/advisories/CVE-2021-32010.md)
  `CVE-2021-32010` · CVE record: Secomea SiteManager and 2 more · CVSS 5.6 Medium · Not analysed yet · Published 4 May 2022 · Tags: Weak cryptography or TLS
- [Missing XSS guards on firmware page](https://agentprime.io/advisories/CVE-2021-32009.md)
  `CVE-2021-32009` · CVE record: Secomea GateManager · CVSS 5.0 Medium · Not analysed yet · Published 11 Mar 2022 · Tags: Cross-site scripting (XSS)
- [GateManager information leak for LinkManager Users](https://agentprime.io/advisories/CVE-2021-32006.md)
  `CVE-2021-32006` · CVE record: Secomea GateManager · CVSS 5.0 Medium · Not analysed yet · Published 7 Mar 2022 · Tags: CWE-274, CWE-275
- [Logged-in Administrator may get unrestricted file system access](https://agentprime.io/advisories/CVE-2021-32008.md)
  `CVE-2021-32008` · CVE record: Secomea GateManager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Mar 2022 · Tags: Path traversal, Information disclosure
- [GateManager does not enforce strict hostname matching for WEB server](https://agentprime.io/advisories/CVE-2021-32004.md)
  `CVE-2021-32004` · CVE record: Secomea GateManager · CVSS 3.7 Low · Not analysed yet · Published 22 Nov 2021 · Tags: CWE-923
- [Insufficient CSRF guards](https://agentprime.io/advisories/CVE-2020-29030.md)
  `CVE-2020-29030` · CVE record: Secomea GateManager · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2021 · Tags: Cross-site request forgery (CSRF)
- [Reflected XSS issues](https://agentprime.io/advisories/CVE-2020-29028.md)
  `CVE-2020-29028` · CVE record: Secomea GateManager · CVSS 6.3 Medium · Not analysed yet · Published 5 Mar 2021 · Tags: Cross-site scripting (XSS)
- [XSS issue due to insufficient sanitization of input field](https://agentprime.io/advisories/CVE-2020-29029.md)
  `CVE-2020-29029` · CVE record: Secomea GateManager · CVSS 7.3 High · Not analysed yet · Published 5 Mar 2021 · Tags: Cross-site scripting (XSS), CWE-20
- [Add integrity check of GateManager firmware](https://agentprime.io/advisories/CVE-2020-29032.md)
  `CVE-2020-29032` · CVE record: Secomea GateManager · CVSS 8.4 High · Not analysed yet · Published 5 Mar 2021 · Tags: CWE-494
- [CSV Formula Injection possible due to improper fields escaping in GateManager](https://agentprime.io/advisories/CVE-2020-29023.md)
  `CVE-2020-29023` · CVE record: Secomea GateManager · CVSS 3.5 Low · Not analysed yet · Published 16 Feb 2021 · Tags: CWE-116
- [Host Header Injection allowing web cache poisoning attacks](https://agentprime.io/advisories/CVE-2020-29022.md)
  `CVE-2020-29022` · CVE record: Secomea GateManager · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2021 · Tags: CWE-159
- [Missing HtppOnly and Secure flags](https://agentprime.io/advisories/CVE-2020-29024.md)
  `CVE-2020-29024` · CVE record: Secomea GateManager · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2021 · Tags: CWE-614
- [Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation](https://agentprime.io/advisories/CVE-2020-29031.md)
  `CVE-2020-29031` · CVE record: Secomea GateManager · CVSS 7.1 High · Not analysed yet · Published 15 Feb 2021 · Tags: CWE-280
- [Path traversal in Secomea GateManager](https://agentprime.io/advisories/CVE-2020-29026.md)
  `CVE-2020-29026` · CVE record: Secomea GateManager · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Feb 2021 · Tags: Path traversal
- [Scripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2020-29021.md)
  `CVE-2020-29021` · CVE record: Secomea GateManager · CVSS 3.5 Low · Not analysed yet · Published 8 Feb 2021 · Tags: CWE-20
- [USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916](https://agentprime.io/advisories/CVE-2020-14512.md)
  `CVE-2020-14512` · CVE record: Secomea GateManager · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2020 · Tags: Weak cryptography or TLS
- [OFF-BY-ONE ERROR CWE-193](https://agentprime.io/advisories/CVE-2020-14510.md)
  `CVE-2020-14510` · CVE record: Secomea GateManager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2020 · Tags: CWE-193
- [OFF-BY-ONE ERROR CWE-193](https://agentprime.io/advisories/CVE-2020-14508.md)
  `CVE-2020-14508` · CVE record: Secomea GateManager · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2020 · Tags: CWE-193

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=secomea-gatemanager>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/secomea-gatemanager/>. Everything for agents: <https://agentprime.io/llms.txt>.