CVE-2023-24015 Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2

A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on...

CVE-2023-22843 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored...

CVE-2023-22843 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored...

CVE-2023-23574

CVE-2023-23574 – Nozomi Networks Guardian/CMC exposes an authenticated blind SQL Injection in the alerts_count component caused by improper input validation. Affected before version 22.6.2, this allows an authenticated attacker to run arbitrary SQL against the web application's DBMS, potentially ...

CVE-2023-23574 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alertscount component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrar...

CVE-2023-22378 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrary...

CVE-2023-22378 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrary...

CVE-2023-22378

Nozomi Networks Guardian and CMC (Nozomi Guardian/CMC) are affected by CVE-2023-22378, a blind SQL Injection vulnerability caused by improper input validation in the sorting parameter. The issue allows an authenticated attacker to execute arbitrary SQL on the target DBMS, with potential to exfilt...

CVE-2023-24477 Session Fixation in Guardian/CMC before 22.6.2

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session...

CVE-2023-23574: Improper Neutralization of Special Elements used in an SQL Command

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alertscount component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrar...

Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

Summary An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Impac...

Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2

Summary A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Impact Authenticated users may be able to extra...

Nozomi Networks Guardian/CMC SQL Injection Vulnerability

Nozomi Networks Guardian/CMC is a centralized management console from Nozomi Networks, Inc. in the United States. An SQL injection vulnerability exists in Nozomi Networks Guardian/CMC that stems from incorrect input validation of sort parameters...

CVE-2023-24477: Session Fixation

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session...

CVE-2023-22378: Improper Neutralization of Special Elements used in an SQL Command

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrary...

PT-2023-5524 · Nozomi Networks · Nozomi Networks Cmc +1

Name of the Vulnerable Software and Affected Versions: Nozomi Networks Guardian and CMC affected versions not specified Description: A blind SQL Injection issue exists due to improper input validation in the sorting parameter, allowing an authenticated attacker to execute arbitrary SQL statements...

DoS via SAML configuration in Guardian/CMC before 22.6.2

Summary An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. Impact The whole application in rendered unusable until a console intervention...

SAP BusinessObjects Business Intelligence Platform Information Disclosure

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a information disclosure vulnerability. Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console CMC - version 430, allows an attack...

SAP BusinessObjects Business Intelligence Platform Information Disclosure (3217303)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a information disclosure vulnerability. Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console CMC - version 430, allows an attacke...

CVE-2022-4259

Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application...