61 matches found
Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0
Summary The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. Impact A local user without administrative privileges could use the...
Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
Summary A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. Impact A local user with administrative credentials for the web interface could submit an archive name containing traversal...
Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0
Summary An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. Impact An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration,...
Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0
Summary A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. Impact An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the...
DoS through oversized audit log entries in Guardian/CMC before 26.2.0
Summary A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. Impact An unauthenticated attacker can submit requests containing excessively large input that is...
Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0
Summary When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. Impact A malicious actor could perform a man-in-the-middle attack and intercept the...
HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0
Summary A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. Impact An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data throug...
Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0
Summary An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. Impact An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for...
HTML injection in Credentials Manager in Guardian/CMC before 26.1.0
Summary A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. Impact An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delet...
HTML injection in Smart Polling in Guardian/CMC before 26.1.0
Summary A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can push malicious remote strategies containing HTML tags through the sync. When a victim views th...
Angular template injection in Reports in Guardian/CMC before 26.1.0
Summary An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. Impact An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially...
HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0
Summary A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. Impact An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags. When a victim view...
HTML injection in Users in Guardian/CMC before 26.1.0
Summary A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. Impact An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags. When a victim attempts to delete a...
Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0
Summary A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. Impact An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victi...
Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0
Summary An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. Impact An authenticated user with view-only privileges for the Threat Intelligence functionality ca...
HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0
Summary A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter. Impact A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured t...
Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0
Summary The server certificate was not verified when an Arc agent connected to a Guardian or CMC. Impact A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and...
HTML injection in Sensor Map in CMC before 25.6.0
Summary A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians' properties. Impact A malicious authenticated user with administrator privileges on a Guardian connected to a CMC can edit the Guardian's properties...
Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0
Summary A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. Impact An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineer...
Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0
Summary A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. Impact An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in...
HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0
Summary A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. Impact An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset...
HTML injection in Asset List in Guardian/CMC before 25.5.0
Summary A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. Impact An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affecte...
Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0
Summary A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. Impact An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a vict...
Client-side path traversal in Guardian/CMC before 25.2.0
Summary A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. Impact An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a...
Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
Summary A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized...
Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0
Summary A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthoriz...
Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
Summary A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing...
Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0
Summary A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing...
Incorrect authorization for CLI in Guardian/CMC before 25.2.0
Summary An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited privileges. Impact An authenticated user with limited privileges can issue administrative CLI commands, altering the device...
Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0
Summary A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. Impact An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in t...
Incorrect authorization for traces request/download in CMC before 25.1.0
Summary An access control vulnerability was discovered in the Request Trace and Download Trace functionalities due to a specific access restriction not being properly enforced for users with limited privileges. Impact An authenticated user with limited privileges can request and download trace...
Privilege escalation in Guardian/CMC before 24.6.0
Summary A privilege escalation vulnerability may enable a service account to elevate its privileges. Impact The sudo rules configured for a local service account were excessively permissive, potentially allowing administrative access if a malicious actor could execute arbitrary commands as that...
Authenticated RCE in update functionality in Guardian/CMC before 24.6.0
Summary An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Impact Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC...
Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0
Summary An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. Impact If a logged-in user with reporting privileges learns how to create a specific application request, they might be...
Missing authentication for local web interface in Arc before v1.6.0
Summary When configuring Arc e.g. during the first setup, a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself. Impact A malicious local user or process,...
Unsafe temporary data privileges on Unix systems in Arc before v1.6.0
Summary On Unix systems Linux, MacOS, Arc uses a temporary file with unsafe privileges. Impact By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges. Mitigation N/A Solution Upgrade to v1.6.0 or later...
Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0
Summary On Windows systems, the Arc configuration files resulted to be world-readable. Impact This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files. Mitigation N/A Solution Upgrade to v1.6.0 or later...
Path traversal via 'zip slip' in Arc before v1.6.0
Summary Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. Impact An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have...
DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1
Summary A Denial of Service Dos vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functionality of our IDS, allows an unauthenticated attacker sending specially crafted malformed network packets to cause the IDS module to...
Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1
Summary Audit records for OpenAPI requests may include sensitive information. Impact Unauthorized access, privilege escalation. Mitigation Nozomi Networks recommends creating specific users for OpenAPI usage, with only the necessary permissions to access the required data sources. Additionally, i...
Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0
Summary A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication. Impact Malicious unauthenticated users with knowledge on the underlying...
Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0
Summary A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Impact Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application...
SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0
Summary A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, may allow an unauthenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application ...
DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0
Summary A Denial of Service Dos vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, allows an unauthenticated attacker to crash the IDS module by sending specially crafted malformed network...
Session Fixation in Guardian/CMC before 22.6.2
Summary In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session. Impact Unauthorized...
Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2
Summary A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Impact Authenticated users may be able to extra...
Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2
Summary An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. Impact An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data th...
Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2
Summary An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Impac...
Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2
Summary A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alertscount component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Impact Authenticated users may be able to...
Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2
Summary A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. Impact The reports section will be partially unavailable for all later attempts to use it, with the report list...