Vulnerabilities > Opennms

DATE CVE VULNERABILITY TITLE RISK
2021-09-24 CVE-2016-6555 Cross-site Scripting vulnerability in Opennms
OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data.
network
opennms CWE-79
4.3
2021-09-24 CVE-2016-6556 Cross-site Scripting vulnerability in Opennms
OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data.
network
opennms CWE-79
4.3
2021-06-01 CVE-2021-25932 Cross-site Scripting vulnerability in Opennms Meridian
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter.
network
opennms CWE-79
3.5
2021-05-25 CVE-2021-25934 Cross-site Scripting vulnerability in Opennms Horizon and Meridian
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter.
network
opennms CWE-79
3.5
2021-05-25 CVE-2021-25935 Cross-site Scripting vulnerability in Opennms Horizon and Meridian
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter.
network
opennms CWE-79
3.5
2021-05-20 CVE-2021-25929 Cross-site Scripting vulnerability in Opennms Horizon and Meridian
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint.
network
opennms CWE-79
3.5
2021-05-20 CVE-2021-25931 Cross-Site Request Forgery (CSRF) vulnerability in Opennms Horizon and Meridian
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`.
network
opennms CWE-352
6.8
2021-05-20 CVE-2021-25933 Cross-site Scripting vulnerability in Opennms Horizon and Meridian
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters.
network
opennms CWE-79
3.5
2021-05-20 CVE-2021-25930 Cross-Site Request Forgery (CSRF) vulnerability in Opennms Horizon and Meridian
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user.
network
opennms CWE-352
4.3
2021-02-17 CVE-2021-3396 Incorrect Authorization vulnerability in Opennms Horizon and Meridian
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
network
low complexity
opennms CWE-863
6.5