CVE-2024-43107

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin. This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-431086.5The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms CVE-2024-43115.4zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An atta CVE-2024-431108.8The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM tha CVE-2024-431116.1Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi CVE-2024-431126.1Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129 CVE-2024-431136.1The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129 CVE-2024-431147.8In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions CVE-2024-431158.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert scrip CVE-2024-431168.8Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.1 CVE-2024-431178.8Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This is CVE-2024-431188.8Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects CVE-2024-431194.3Missing Authorization vulnerability in Aruba.It Aruba HiSpeed Cache allows Exploiting Incorrectly Configured Access Control Security Levels.