CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-25931
https://notcve.org/view.php?id=CVE-2021-25931
20 May 2021 — In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a n... • https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-25929
https://notcve.org/view.php?id=CVE-2021-25929
20 May 2021 — In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading ... • https://github.com/OpenNMS/opennms/commit/66c1f626bf38a7d1a9530b4d68598269ee5245a2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2021-25930
https://notcve.org/view.php?id=CVE-2021-25930
20 May 2021 — In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list. E... • https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 2%CPEs: 7EXPL: 0CVE-2021-3396
https://notcve.org/view.php?id=CVE-2021-3396
17 Feb 2021 — OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions. OpenNMS Meridian versiones 2016, 2017, 2018 anteriores a 2018.1.25, versiones 2019 anteriores a 2019.1.16 y versiones 2020 anteriores a 2020.1.5, Horizon versiones 1.2 hasta 27.0.4 y Newts versiones anteriores a 1.5.3, presenta un Control de Acceso Incorrecto, que pe... • https://www.opennms.com •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1652 – Junos Space: OpenNMS is accessible via port 9443
https://notcve.org/view.php?id=CVE-2020-1652
17 Jul 2020 — OpenNMS is accessible via port 9443 OpenNMS puede ser accedida por medio del puerto 9443 • https://kb.juniper.net • CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2020-12760
https://notcve.org/view.php?id=CVE-2020-12760
11 May 2020 — An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions. Se detectó un problema en OpenNMS Horizon versiones anteriores a 26.0.1 y Meridian versiones anteriores a 2018.1.19 y versiones 2019 anteriores a 2019.1.7... • https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-11886
https://notcve.org/view.php?id=CVE-2020-11886
17 Apr 2020 — OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21. OpenNMS Horizon and Meridian, permite una inyección HQL en el archivo element/nodeList.htm (también se conoce como NodeListController) por medio de snmpParm o snmpParmValue en la función addCriteriaForSnmpParm. Esto a... • https://issues.opennms.org/browse/NMS-12572 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2015-7856
https://notcve.org/view.php?id=CVE-2015-7856
16 Oct 2015 — OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials. OpenNMS tiene una contraseña por defecto de rtc para la cuenta rtc, lo que hace más fácil para atacantes remotos obtener acceso aprovechando conocer las credenciales. • http://www.opennms.org/wiki/CVE-2015-0975 • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 44EXPL: 0CVE-2014-3960
https://notcve.org/view.php?id=CVE-2014-3960
04 Jun 2014 — Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en OpenNMS anterior a 1.12.7 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/58748 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 119EXPL: 0CVE-2012-0936
https://notcve.org/view.php?id=CVE-2012-0936
29 Jan 2012 — Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to login. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java en OpenNMS v1.8.x antes de v1.8.17, v1.9.93 y anteriores, ... • http://fisheye.opennms.org/browse/opennms/features/springframework-security/src/main/java/org/opennms/web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java?r2=d2ce15470cb6c87c115c918eb86ef147486a9166&r1=80b80e110e4bce568fc2c6c0a15a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •