CVE-2020-12282: Cross-Site Request Forgery (CSRF)

iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. This can be combined with reflected XSS...

CVE-2020-12837: Unrestricted Upload of File with Dangerous Type

ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must be used...

CVE-2020-12843: Unrestricted Upload of File with Dangerous Type

ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV must be used...

PT-2020-13286

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows remote attackers to upload sound files via the "/index.php" API endpoint, potentially leading to unauthorized access or data modification. Recommendations For ismartgate PRO version...

PT-2020-13338

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows for clickjacking. Recommendations For ismartgate PRO version 1.5.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2020-12841: Cross-Site Request Forgery (CSRF)

ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php...

CVE-2020-12839: Incorrect Permission Assignment for Critical Resource

ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php...

CVE-2020-12838: Incorrect Permission Assignment for Critical Resource

ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php...

PT-2020-13092

Name of the Vulnerable Software and Affected Versions iSmartgate PRO version 1.5.9 Description The issue allows remote attackers to create a new user via the "/index.php" API endpoint. This is achieved through a CSRF attack. Recommendations For iSmartgate PRO version 1.5.9, consider implementing...

PT-2020-13284

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows for privilege escalation by appending PHP code to the "/cron/mailAdmin.php" API endpoint. Recommendations For ismartgate PRO version 1.5.9, consider restricting access to the...

PT-2020-13093

Name of the Vulnerable Software and Affected Versions iSmartgate PRO version 1.5.9 Description The issue concerns a CSRF vulnerability that can be exploited via the busca parameter in the form used for searching for users, accessible through the "/index.php" API endpoint. This vulnerability can b...

PT-2020-13283

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows malicious file uploads through the form used for uploading images to garage doors, requiring the use of PNG magic bytes. Recommendations For ismartgate PRO version 1.5.9, consider...

CVE-2020-12842: Incorrect Permission Assignment for Critical Resource

ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php...

CVE-2020-12840: Cross-Site Request Forgery (CSRF)

ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php...

CVE-2020-12281: Cross-Site Request Forgery (CSRF)

iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php...

PT-2020-13289

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows malicious file uploads through the form used for uploading sounds to garage doors, requiring the use of magic bytes for WAV files. Recommendations For ismartgate PRO version 1.5.9,...

CVE-2020-12280: Cross-Site Request Forgery (CSRF)

iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php...

CVE-2020-13119: Improper Restriction of Rendered UI Layers or Frames

ismartgate PRO 1.5.9 is vulnerable to clickjacking...

PT-2020-13091

Name of the Vulnerable Software and Affected Versions iSmartgate PRO version 1.5.9 Description The issue allows remote attackers to open or close a specified garage door or gate. This is achieved via the "/isg/opendoor.php" API endpoint. Recommendations For iSmartgate PRO version 1.5.9, consider...

PT-2020-13287

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows remote attackers to upload image files via the "/index.php" API endpoint, potentially leading to unauthorized access or data modification. Recommendations For ismartgate PRO version...