# cve.now: Secomea

The newest entries naming Secomea as an affected vendor (up to 200), of 48 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-1759](https://cve.now/CVE-2026-1759.md): Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. (CVSS 6.5)
- [CVE-2026-1758](https://cve.now/CVE-2026-1758.md): Session Fixation (CVSS 8.3)
- [CVE-2025-14716](https://cve.now/CVE-2025-14716.md): Unauthorized access to information (CVSS 6.5)
- [CVE-2021-32007](https://cve.now/CVE-2021-32007.md): Missing security header: Referrer-Policy URL (CVSS 3.5)
- [CVE-2024-1969](https://cve.now/CVE-2024-1969.md): Heap buffer overflow (CVSS 8.2)
- [CVE-2024-1579](https://cve.now/CVE-2024-1579.md): Insufficient seeding of random number generator (CVSS 8.1)
- [CVE-2023-3675](https://cve.now/CVE-2023-3675.md): Insufficient input validation when downloading certain file types. (CVSS 6.5)
- [CVE-2023-2912](https://cve.now/CVE-2023-2912.md): SiteManager Embedded service disruption (CVSS 5.9)
- [CVE-2022-38125](https://cve.now/CVE-2022-38125.md): FTP Agent forwards traffic on inactive ports to LinkManager (CVSS 2.9)
- [CVE-2023-0317](https://cve.now/CVE-2023-0317.md): GateManager debug interface is included in non-debug builds (CVSS 4.9)
- [CVE-2022-4308](https://cve.now/CVE-2022-4308.md): Clear-text passwords in configuration files (CVSS 6.1)
- [CVE-2022-38124](https://cve.now/CVE-2022-38124.md): Unwanted debug tool (CVSS 5.7)
- [CVE-2022-2752](https://cve.now/CVE-2022-2752.md): Potential vulnerabilities in GM login process (CVSS 5.5)
- [CVE-2022-38123](https://cve.now/CVE-2022-38123.md): Insufficient validation of plugin files (CVSS 8.7)
- [CVE-2022-25786](https://cve.now/CVE-2022-25786.md): GateManager debug interface is included in production builds (CVSS 4.9)
- [CVE-2022-25787](https://cve.now/CVE-2022-25787.md): GTA URLs issued by LMM WEB API may leak information (CVSS 7.5)
- [CVE-2022-25785](https://cve.now/CVE-2022-25785.md): Buffer overrun (CVSS 6.6)
- [CVE-2022-25784](https://cve.now/CVE-2022-25784.md): User controllable HTML element attribute (potential XSS) (CVSS 9.1)
- [CVE-2022-25783](https://cve.now/CVE-2022-25783.md): Hacking attempts from logged-in users are not properly logged by GM (CVSS 4.3)
- [CVE-2022-25782](https://cve.now/CVE-2022-25782.md): Insufficient privilege checks on object access and updates. (CVSS 5.4)
- [CVE-2022-25781](https://cve.now/CVE-2022-25781.md): Reflected XSS issues in GateManager (CVSS 4.2)
- [CVE-2022-25780](https://cve.now/CVE-2022-25780.md): Information leak via device availability query function (CVSS 4.3)
- [CVE-2022-25779](https://cve.now/CVE-2022-25779.md): Insufficient scope checks allows adding unrelated audit log entries (CVSS 4.3)
- [CVE-2022-25778](https://cve.now/CVE-2022-25778.md): Unload handlers may unintentionally defeat CSRF guards (CVSS 4.2)
- [CVE-2021-32010](https://cve.now/CVE-2021-32010.md): Clients may connect to a GateManager with TLS 1.0 (CVSS 5.6)
- [CVE-2021-32009](https://cve.now/CVE-2021-32009.md): Missing XSS guards on firmware page (CVSS 5.0)
- [CVE-2021-32005](https://cve.now/CVE-2021-32005.md): SiteManager Log View XSS Issue (CVSS 6.5)
- [CVE-2021-32006](https://cve.now/CVE-2021-32006.md): GateManager information leak for LinkManager Users (CVSS 5.0)
- [CVE-2021-32008](https://cve.now/CVE-2021-32008.md): Logged-in Administrator may get unrestricted file system access (CVSS 9.9)
- [CVE-2021-32004](https://cve.now/CVE-2021-32004.md): GateManager does not enforce strict hostname matching for WEB server (CVSS 3.7)
- [CVE-2021-32003](https://cve.now/CVE-2021-32003.md): Configuration service port remains open 10 minutes after reboot even when already provisioned (CVSS 8.0)
- [CVE-2021-32002](https://cve.now/CVE-2021-32002.md): SiteManager troubleshooter allows access without authentication from local network (CVSS 4.3)
- [CVE-2020-29030](https://cve.now/CVE-2020-29030.md): Insufficient CSRF guards (CVSS 8.1)
- [CVE-2020-29020](https://cve.now/CVE-2020-29020.md): Reject Remote Management via Cellular UPLINK2 (CVSS 9.1)
- [CVE-2020-29028](https://cve.now/CVE-2020-29028.md): Reflected XSS issues (CVSS 6.3)
- [CVE-2020-29029](https://cve.now/CVE-2020-29029.md): XSS issue due to insufficient sanitization of input field (CVSS 7.3)
- [CVE-2020-29032](https://cve.now/CVE-2020-29032.md): Add integrity check of GateManager firmware (CVSS 8.4)
- [CVE-2020-29027](https://cve.now/CVE-2020-29027.md): Reflected Cross Site Scripting (CVSS 5.4)
- [CVE-2020-29025](https://cve.now/CVE-2020-29025.md): DOM-based Javascript injection (CVSS 5.4)
- [CVE-2020-29023](https://cve.now/CVE-2020-29023.md): CSV Formula Injection possible due to improper fields escaping in GateManager (CVSS 3.5)
- [CVE-2020-29022](https://cve.now/CVE-2020-29022.md): Host Header Injection allowing web cache poisoning attacks (CVSS 5.3)
- [CVE-2020-29024](https://cve.now/CVE-2020-29024.md): Missing HtppOnly and Secure flags (CVSS 5.3)
- [CVE-2020-29031](https://cve.now/CVE-2020-29031.md): Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation (CVSS 7.1)
- [CVE-2020-29026](https://cve.now/CVE-2020-29026.md): A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with adminis (CVSS 9.0)
- [CVE-2020-29021](https://cve.now/CVE-2020-29021.md): Scripting tag chars \< \> not filtered in input fields could cause Cross-Site Scripting (XSS) (CVSS 3.5)
- [CVE-2020-14512](https://cve.now/CVE-2020-14512.md): USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916 (CVSS 8.1)
- [CVE-2020-14510](https://cve.now/CVE-2020-14510.md): OFF-BY-ONE ERROR CWE-193 (CVSS 9.8)
- [CVE-2020-14508](https://cve.now/CVE-2020-14508.md): OFF-BY-ONE ERROR CWE-193 (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/secomea
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.