| CVE-2025-40890 |
A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of…
|
5.8
Medium
|
Nov 25, 2025 |
| CVE-2025-40888 |
A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter
|
6.0
Medium
|
Oct 7, 2025 |
| CVE-2025-40889 |
A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input…
|
7.2
High
|
Oct 7, 2025 |
| CVE-2025-40887 |
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter
|
6.0
Medium
|
Oct 7, 2025 |
| CVE-2025-40886 |
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter
|
7.7
High
|
Oct 7, 2025 |
| CVE-2025-40885 |
A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input…
|
6.0
Medium
|
Oct 7, 2025 |
| CVE-2025-3719 |
An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being…
|
7.2
High
|
Oct 7, 2025 |
| CVE-2025-3718 |
A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing…
|
5.8
Medium
|
Oct 7, 2025 |
| CVE-2025-1501 |
An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before…
|
5.3
Medium
|
Aug 26, 2025 |
| CVE-2024-13090 |
A privilege escalation vulnerability may enable a service account to elevate its privileges
|
7.3
High
|
Jun 10, 2025 |
| CVE-2024-13089 |
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to…
|
7.5
High
|
Jun 10, 2025 |
| CVE-2024-4465 |
An access control vulnerability was discovered in the Reports section due to a specific access restriction not being…
|
6.0
Medium
|
Sep 11, 2024 |
| CVE-2023-6916 |
Audit records for OpenAPI requests may include sensitive information
|
7.2
High
|
Apr 10, 2024 |
| CVE-2023-5253 |
A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks…
|
5.3
Medium
|
Jan 15, 2024 |
| CVE-2023-32649 |
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain…
|
7.5
High
|
Sep 19, 2023 |
| CVE-2023-29245 |
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields…
|
8.1
High
|
Sep 19, 2023 |
| CVE-2023-2567 |
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in…
|
8.8
High
|
Sep 19, 2023 |
| CVE-2023-23903 |
An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not…
|
4.9
Medium
|
Aug 9, 2023 |
| CVE-2023-24015 |
A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user…
|
4.3
Medium
|
Aug 9, 2023 |
| CVE-2023-24471 |
An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being…
|
6.5
Medium
|
Aug 9, 2023 |
| CVE-2023-22843 |
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript…
|
6.4
Medium
|
Aug 9, 2023 |
| CVE-2023-23574 |
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the…
|
8.8
High
|
Aug 9, 2023 |
| CVE-2023-22378 |
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting…
|
8.8
High
|
Aug 9, 2023 |
| CVE-2023-24477 |
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before…
|
7.0
High
|
Aug 9, 2023 |
| CVE-2022-4259 |
Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and…
|
8.8
High
|
May 4, 2023 |