CVE-2021-3396

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

CVE-2021-3396

CVE-2021-3396 affects OpenNMS Meridian (2016, 2017, 2018 before 2018.1.25; 2019 before 2019.1.16; 2020 before 2020.1.5), Horizon 1.2 through 27.0.4, and Newts

Tarus Balog OpenNMS Meridian Security Vulnerability

Tarus Balog OpenNMS Meridian is an application from Canary Tarus Balog, Inc. It provides for building network monitoring solutions. A security vulnerability exists in OpenNMS Meridian that arises from a network system or product that does not properly restrict access to resources from unauthorize...

OpenNMS Group OpenNMS Code Issues Vulnerabilities

OpenNMS Group OpenNMS is an open source enterprise network monitoring and network management platform from OpenNMS Group, Inc. OpenNMS Horizon and Meridian are different versions of OpenNMS. A security vulnerability exists in the ActiveMQ channel configuration in OpenNMS Horizon versions prior to...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

Deserialization of untrusted data

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

This CVE concerns OpenNMS Horizon (before 26.0.1) and Meridian (before 2018.1.19 and before 2019.1.7) where ActiveMQ channel configuration enabled arbitrary Java deserialization (ActiveMQ Minion payload deserialization), enabling remote code execution for any authenticated channel user. Affected ...

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

Sql injection

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

CVE-2020-11886

OpenNMS Horizon and Meridian are affected by CVE-2020-11886 due to a HQL Injection vulnerability in the NodeListController (element/nodeList.htm) reachable via snmpParms. The issue allows adding criteria through snmpParm or snmpParmValue, enabling injection in the HQL query. Affected versions are...

N.J.'s Largest Hospital System Pays Up in Ransomware Attack

New Jersey’s largest hospital system said that it has paid hackers a ransom after a ransomware attack disrupted its services earlier this month. Hackensack Meridian Health, a $6 billion non-profit health provider system based in Edison, N.J., operates 17 hospitals, nursing homes and outpatient...

php: Out-of-bound read in timelib_meridian()

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelibmeridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parsedate.c...

php: Out-of-bound read in timelib_meridian()

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelibmeridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parsedate.c...

CVE-2017-16642

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelibmeridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parsedate.c...

meridianplaza.com XSS vulnerability

Open Bug Bounty ID: OBB-288983 Description| Value ---|--- Affected Website:| meridianplaza.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Meridian BOB BRB–Info&Tickets - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Meridian BOB BRB–Info&Tickets published at the 'play' market has multiple vulnerabilities...

pbxbook.com XSS vulnerability

Vulnerable URL: https://pbxbook.com/meridian/admin/ftrcodes.html/"--!" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 411797 VIP website status:| No Coordinated Disclosure Timeline...