Command centre

This hub aggregates every CVE we track for Command centre, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Command centre.

• CVE-2024-23194Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. This issue affects: ...3.3Jul 11, 2024
• CVE-2024-21838 Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Ce...6.8Mar 5, 2024
• CVE-2024-21815 Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher...9.1Mar 5, 2024
• CVE-2023-46686 A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protoc...5.5Dec 18, 2023
• CVE-2023-23584 An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable. This issu...4.3Dec 18, 2023
• CVE-2023-23576 Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in...4.3Dec 18, 2023
• CVE-2023-23570 Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command C...5.4Dec 18, 2023
• CVE-2023-22439 Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagno...3.1Dec 18, 2023
• CVE-2023-23568 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affects Command Centre: vEL 8.90 prior to v...4.3Jul 25, 2023
• CVE-2023-22363Access Zone stack overflow6.5Jul 24, 2023
• CVE-2023-25074Competency access levels not enforced in the server7.1Jul 24, 2023
• CVE-2023-22428 Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 p...7.6Jul 24, 2023
• CVE-2022-26348Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk,...8.2Jul 6, 2022
• CVE-2021-23193Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from the Command Centre...8.1Nov 18, 2021
• CVE-2021-23197Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Ga...5.2Nov 18, 2021