Advisories · Technology
Nozomi Networks CMC.
Every CVE that names Nozomi Networks CMC among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Authenticated RCE in update functionality in Guardian/CMC before 26.4.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Command injection
- CVSS 7.5 High
Update bundle signature bypass in Guardian/CMC before 26.4.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Weak cryptography or TLS
- CVSS 5.1 Medium
Cross-site request forgery in the Guardian/CMC login before 26.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Broken access control
- CVSS 5.3 Medium
Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- CWE-671
- CVSS 6.4 Medium
Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Broken access control
- CVSS 5.1 Medium
Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Code injection
- CVSS 7.2 High
Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Privilege escalation
- CVSS 8.7 High
DoS through oversized audit log entries in Guardian/CMC before 26.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Denial of service
- CVSS 6.9 Medium
Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Authentication bypass
- CVSS 5.3 Medium
Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Open redirect
- CVSS 4.8 Medium
HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
HTML injection in Smart Polling in Guardian/CMC before 26.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
HTML injection in Users in Guardian/CMC before 26.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
HTML injection in Credentials Manager in Guardian/CMC before 26.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Angular template injection in Reports in Guardian/CMC before 26.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Code injection
- CVSS 7.1 High
Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 7.2 High
Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Broken access control
- CVSS 2.0 Low
HTML injection in Sensor Map in CMC before 25.6.0
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 2.1 Low
HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 7.2 High
Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Path traversal
- CVSS 5.3 Medium
HTML injection in Asset List in Guardian/CMC before 25.5.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 7.1 High
Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 2.3 Low
HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 7.2 High
Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Path traversal
- CVSS 6.0 Medium
Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 7.7 High
Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 6.0 Medium
Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 7.2 High
Incorrect authorization for CLI in Guardian/CMC before 25.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Broken access control
- CVSS 5.8 Medium
Client-side path traversal in Guardian/CMC before 25.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Path traversal
- CVSS 5.3 Medium
Incorrect authorization for traces request/download in CMC before 25.1.0
- Nozomi Networks CMC
- Broken access control
- CVSS 7.3 High
Privilege escalation in Guardian/CMC before 24.6.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Privilege escalation
- CVSS 7.5 High
Authenticated RCE in update functionality in Guardian/CMC before 24.6.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Command injection
- CVSS 5.8 Medium
Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Broken access control
- CVSS 7.5 High
Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Information disclosure
- CVSS 6.3 Medium
Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Authentication bypass
- CVSS 8.2 High
DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- CWE-1286
- CVSS 9.2 CriticalCritical · CVSS 9+
SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 8.7 High
Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 6.9 Medium
DoS via SAML configuration in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- CWE-1286
- CVSS 5.3 Medium
Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- CWE-1286
- CVSS 7.1 High
Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Broken access control
- CVSS 7.3 High
Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site scripting (XSS)
- CVSS 8.7 High
Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 8.7 High
Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- SQL injection
- CVSS 5.4 Medium
Session Fixation in Guardian/CMC before 22.6.2
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Authentication bypass
- CVSS 8.7 High
Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2
- Nozomi Networks CMC
- Nozomi Networks Guardian
- SQL injection
- CVSS 8.6 High
Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- CWE-20
- CVSS 8.6 High
Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- CWE-20
- CVSS 8.6 High
Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Command injection
- CVSS 8.6 High
Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Path traversal