PT-2023-16573 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: Cross-site scripting in outage/list.htm allows an attacker access to confidential session information. The software is intended for installation...

PT-2023-16571 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages could allow an attacker access to confidential session...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-class network monitoring and network management platform from Opennms Group, Inc. A security vulnerability exists in Opennms Group OpenNMS Meridian, Horizon, which stems from a cross-site scripting XSS vulnerability in graph results that can be...

GHSA-79JR-8FHM-8WV3 OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information...

CVE-2023-0846 Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon...

CVE-2023-0846 Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon...

PT-2023-8929 · Opennms · Opennms Horizon +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: The issue is related to unauthenticated, stored cross-site scripting in the display of alarm reduction keys, which could allow an attacker to...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based Opennms Group. A security vulnerability exists in OpenNMS Horizon and Meridian. An attacker could exploit this vulnerability to conduct a cross-site scripting attack to...

meridian-systems.co.uk Cross Site Scripting vulnerability OBB-2981005

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the Meridian Cooperative Utility software, related to deficiencies in access control, allows for obtaining complete information about the user.

The vulnerability of the Meridian Cooperative Utility software is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to obtain complete information about the user...

CVE-2022-29578

Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage...

CVE-2022-29578

Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage...

Information disclosure

Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage...

CVE-2022-29578

Summary of CVE-2022-29578 : Meridian Cooperative Utility Software (versions 22.02 and 22.03) has an improper access control flaw that could allow a remote attacker to disclose private user information such as name, address, and daily energy usage. The issue is rooted in access control (CWE-284) a...

Meridian Cooperative Meridian 授权问题漏洞

Meridian Cooperative Meridian is a utility tool from Meridian Cooperative USA. It is used for daily office operations. Meridian Cooperative Meridian is vulnerable to an authorization issue. A remote attacker could exploit this vulnerability to obtain sensitive information such as name, address, a...

OpenNMS Horizon vulnerable to XSS

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the...

GHSA-9HHC-CC6C-99HH OpenNMS Horizon vulnerable to XSS

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the...

GHSA-C3MP-9VX3-2RVV OpenNMS Horizon RCE via JEXL2 expression

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

OpenNMS Horizon RCE via JEXL2 expression

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

OpenNMS Horizon RCE via Unsafe Deserialization

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...