Gonicus develops system administration and identity-management software, with a narrow but strategically positioned product portfolio including GOsa and its system administration suite. The durable signal centers on web-facing authentication and code-generation pathways, where vulnerabilities recur around improper authentication mechanisms, code injection, and cross-site scripting; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Gonicus over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-1000528MEDIUM GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) th | Jun 26, 2018 | 6.1 | 41 | NO | NO |
CVE-2019-11187CRITICAL Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring " | Aug 15, 2019 | 9.8 | 29 | NO | NO |
CVE-2003-1412MEDIUM PHP remote file inclusion vulnerability in index.php for GONiCUS System Administrator (GOsa) 1.0 allows remote attackers to execute arbitrary PHP code via the plugin parameter to ( | Dec 31, 2003 | 6.8 | 27 | NO | YES |
CVE-2007-0313HIGH Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via craft | Jan 18, 2007 | 9.0 | 22 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Gonicus.
Media articles that mention a CVE ID that affects a product developed by Gonicus — matched by CVE ID, not by vendor name.