CVE-2024-43107: Improper Certificate Validation

Improper Certificate Validation CWE-295 in the Gallagher Milestone Integration Plugin MIP permits unauthenticated messages e.g. alarm events to be sent to the Plugin. This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior...

PT-2025-10560

Name of the Vulnerable Software and Affected Versions Gallagher Milestone Integration Plugin MIP versions prior to 4.0.32 Gallagher Milestone Integration Plugin MIP version 3.0 and earlier Description The issue is related to improper certificate validation, allowing unauthenticated messages, such...

CVE-2024-41724: Improper Certificate Validation

Improper Certificate Validation CWE-295 in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affects all versions of Gallagher Command Centre prior to 9.20.1043...

CVE-2020-16103

Type confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236MR1; 8.20 versions prior to 8.20.1166MR3; 8.10 versions prior to 8.10.1211MR5; versi...

CVE-2020-16102

Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration, potentially causing the server to crash and fail to restart. This issue affects: Gallagher Command Centre 8.30 versions prior to...

CVE-2020-16096

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

CVE-2020-16104

SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects:...

CVE-2024-21815

Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...

CVE-2024-42407

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

CVE-2024-42407

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

CVE-2024-42407

CVE-2024-42407 affects Gallagher Command Centre Server: the Alarm Transmitter feature can cause insertion of sensitive information into log files, enabling an authenticated Operator to view restricted data. Affected versions are Command Centre Server 9.10 before 9.10.2149 (MR4), 9.00 before 9.00....

CVE-2024-42407

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

CVE-2024-42407

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

CVE-2024-42407: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

Gallagher Command Centre Server 安全漏洞

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server that stems from the insertion of sensitive information into a log file during the Alarm Sender...

PT-2024-29930

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre Server versions 8.80 and prior Gallagher Command Centre Server versions 8.90 through 8.90.2356 Gallagher Command Centre Server versions 9.00 through 9.00.2374 Gallagher Command Centre Server versions 9.10 through...

Gallagher Controller 6000和Gallagher Controller 7000 安全漏洞

The Gallagher Controller 6000 and Gallagher Controller 7000 are both products of Gallagher New Zealand.The Gallagher Controller 6000 is an interface between a Gallagher Command Center server and distributed field hardware. The Gallagher Controller 7000 is a powerful network connected controller. ...

WordPress Transients Manager plugin <= 2.0.6 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by David Gallagher BatFeats in WordPress Plugin Transients Manager versions = 2.0.6...

CVE-2024-24972

Buffer Copy without Checking Size of Input CWE-120 in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Service. Gallagher recommend the diagnostic web page is not enabled default is off...

CVE-2024-24972

The CVE-2024-24972 issue affects Gallagher Controller 6000 and Controller 7000 via a Buffer Copy without Checking Size of Input in the diagnostic web interface, enabling an authorized and authenticated operator to reboot the controller and cause a Denial of Service. Affected firmware histories in...