CVE-2024-46943 | High | 7.5 | 2024-09-15 | An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate… |
CVE-2024-46942 | Medium | 6.5 | 2024-09-15 | In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight… |
CVE-2018-1132 | High | 7.5 | 2018-06-20 | A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller… |
CVE-2018-1078 | Critical | 9.8 | 2018-03-16 | OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or shoul… |
CVE-2017-1000411 | High | 7.5 | 2018-01-31 | OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expired' flows take up t… |
CVE-2017-1000406 | High | 7.5 | 2017-11-30 | OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleare… |
CVE-2015-1778 | Critical | 9.8 | 2017-06-27 | The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combi… |
CVE-2014-8149 | High | 8.8 | 2017-06-27 | OpenDaylight defense4all 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files. |
CVE-2017-1000361 | High | 7.5 | 2017-04-24 | DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Com… |
CVE-2017-1000360 | Medium | 5.3 | 2017-04-24 | StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-md… |
CVE-2017-1000359 | Medium | 5.3 | 2017-04-24 | Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The test… |
CVE-2017-1000358 | Medium | 6.5 | 2017-04-24 | Controller throws an exception and does not allow user to add subsequent flow for a particular switch. Component: OpenDaylight odl-restconf feature contains th… |
CVE-2017-1000357 | High | 7.5 | 2017-04-24 | Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch… |
CVE-2015-1612 | High | 7.5 | 2017-04-04 | OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP… |
CVE-2015-1611 | High | 7.5 | 2017-04-04 | OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injecti… |
CVE-2015-1610 | Medium | 5.3 | 2017-03-20 | hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing." |
CVE-2014-5035 | | | 2014-08-26 | The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an ent… |