Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0

Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0

Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0

Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2

Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2

Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0

Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0

Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0

Incorrect authorization for CLI in Guardian/CMC before 25.2.0

DoS through oversized audit log entries in Guardian/CMC before 26.2.0

DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1

Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0

DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0

SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0

Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection

Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1

Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0

Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0

OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote…

Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

Session Fixation in Guardian/CMC before 22.6.2

Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0

Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0

Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0

Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2

Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2

HTML injection in Asset List in Guardian/CMC before 25.5.0

Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name

HTML injection in Smart Polling in Guardian/CMC before 26.1.0

HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0

Client-side path traversal in Guardian/CMC before 25.2.0

Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0

Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0

DoS via SAML configuration in Guardian/CMC before 22.6.2

Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files

HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0

HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0

HTML injection in Users in Guardian/CMC before 26.1.0

HTML injection in Credentials Manager in Guardian/CMC before 26.1.0

Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0

Angular template injection in Reports in Guardian/CMC before 26.1.0

Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2