CVE-2023-0869 Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state th...

CVE-2023-0869 Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state th...

PT-2023-16572 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: Reflected cross-site scripting in graph results could allow an attacker to steal session cookies. The software is intended for installation with...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-class network monitoring and network management platform from the U.S.-based Opennms Group. A security vulnerability exists in OpenNMS Meridian, Horizon, which is caused by a cross-site scripting XSS vulnerability in the webapp jsp page, which c...

Opennms Group OpenNMS 日志信息泄露漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from US-based Opennms Group. A security vulnerability exists in OpenNMS Meridian , Horizon , which originates from the possibility of inserting sensitive information into log files if the...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-class network monitoring and network management platform from Opennms Group, Inc. A security vulnerability exists in Opennms Group OpenNMS Meridian, Horizon, which stems from a cross-site scripting XSS vulnerability in graph results that can be...

PT-2023-16544 · Opennms +1 · Opennms Meridian +2

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: The issue allows disclosure of usernames and passwords if the logging level is set to debug, potentially inserting sensitive information into...

PT-2023-16573 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: Cross-site scripting in outage/list.htm allows an attacker access to confidential session information. The software is intended for installation...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from US-based Opennms Group. A security vulnerability exists in Opennms Group OpenNMS Meridian and Horizon, which originates from a cross-site scripting vulnerability in the outage/list.ht...

PT-2023-16571 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.0 OpenNMS Horizon versions prior to 31.0.4 Description: Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages could allow an attacker access to confidential session...

GHSA-79JR-8FHM-8WV3 OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information...

CVE-2023-0846

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon...

Cross site scripting

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon...

CVE-2023-0846 Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon...

CVE-2023-0846

CVE-2023-0846 is an unauthenticated, stored cross-site scripting vulnerability in OpenNMS Horizon and Meridian, affecting the display of alarm reduction keys. The root cause is described as inadequate protection of the web page structure, enabling an attacker to access confidential session inform...

CVE-2023-0846 Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon...

Opennms Group OpenNMS 跨站脚本漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based Opennms Group. A security vulnerability exists in OpenNMS Horizon and Meridian. An attacker could exploit this vulnerability to conduct a cross-site scripting attack to...

CVE-2016-6556 OpenNMS Stored XSS via SNMP Agent Data

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This...

CVE-2016-6556

OpenNMS CVE-2016-6556 affects version 18.0.1 and earlier, due to insufficient filtering of SNMP agent data (sysName/sysContact), enabling stored XSS when web UI data is viewed. The issue was fixed in version 18.0.2 (Sept 20, 2016). No exploitation details are provided in the sources. The related ...

CVE-2016-6555 OpenNMS Stored XSS via SNMP Trap Alerts

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in...