CVE-2023-40314 | Medium | 5.8 | 2023-11-16 |
Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. Th… |
CVE-2023-40612 | Medium | 5.3 | 2023-08-23 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerabl… |
CVE-2023-40315 | Medium | 5.3 | 2023-08-17 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate thei… |
CVE-2023-40313 | High | 7.1 | 2023-08-17 | A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary… |
CVE-2023-40312 | Medium | 6.7 | 2023-08-14 | Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple pla… |
CVE-2023-40311 | Medium | 6.7 | 2023-08-14 | Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platfo… |
CVE-2023-0872 | High | 8.2 | 2023-08-14 | The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of p… |
CVE-2023-0871 | Medium | 5.4 | 2023-08-11 | XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE… |
CVE-2023-0870 | High | 8.1 | 2023-03-22 | A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain… |
CVE-2023-0869 | Medium | 5.8 | 2023-02-23 | Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The… |
CVE-2023-0868 | Medium | 6.7 | 2023-02-23 | Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. U… |
CVE-2023-0867 | Medium | 6.7 | 2023-02-23 | Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an atta… |
CVE-2023-0815 | Medium | 6.8 | 2023-02-23 | Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and… |
CVE-2023-0846 | Medium | 6.7 | 2023-02-22 | Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacke… |
CVE-2016-6556 | High | 7.1 | 2021-09-24 | OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP '… |
CVE-2016-6555 | High | 7.1 | 2021-09-24 | OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP tr… |
CVE-2021-25932 | Medium | 5.4 | 2021-06-01 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25935 | Medium | 5.4 | 2021-05-25 | In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2… |
CVE-2021-25934 | Medium | 5.4 | 2021-05-25 | In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2… |
CVE-2021-25933 | Medium | 4.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25931 | High | 8.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25929 | Medium | 4.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25930 | Medium | 4.3 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-3396 | High | 8.8 | 2021-02-17 | OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect… |
CVE-2020-1652 | Medium | 5.6 | 2020-07-17 | OpenNMS is accessible via port 9443 |
CVE-2020-12760 | High | 8.8 | 2020-05-11 | An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed fo… |
CVE-2020-11886 | High | 8.1 | 2020-04-17 | OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm… |
CVE-2015-7856 | | | 2015-10-16 | OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentia… |
CVE-2014-3960 | | | 2014-06-04 | Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vect… |
CVE-2008-6095 | | | 2009-02-09 | Cross-site scripting (XSS) vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewN… |