366 matches found
CVE-2021-25931
CVE-2021-25931 describes a CSRF vulnerability in OpenNMS Horizon (opennms-1-0-stable up to 27.1.0-1) and OpenNMS Meridian (meridian-foundation-2015.1.0-1 to 2020.1.6-1) where there is no CSRF protection for the endpoint /opennms/admin/userGroupView/users/updateUser. The flaw enables an attacker t...
CVE-2021-25930
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and...
CVE-2021-25930
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and...
Cross site request forgery (csrf)
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and...
CVE-2021-25929
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since...
CVE-2021-25929
OpenNMS Horizon and Meridian are vulnerable to Stored Cross-Site Scripting due to lack of validation on the name parameter in the noticeWizard endpoint. An authenticated attacker could inject script and trick other admins into downloading malicious files. Affected: OpenNMS Horizon versions opennm...
CVE-2021-25929
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since...
CVE-2021-25930
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and...
CVE-2021-25930
CVE-2021-25930 affects OpenNMS Horizon (opennms-1-0-stable to opennms-27.1.0-1) and OpenNMS Meridian (meridian-foundation-2015.1.0-1 to meridian-foundation-2020.1.6-1). Root cause: CSRF protection is absent and there is no validation of an existing username when renaming a user. Impact: privilege...
CVE-2021-25930
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and...
Opennms Group OpenNMS 跨站请求伪造漏洞
Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the U.S.-based OpenNMS Group Opennms Group. A cross-site request forgery vulnerability exists in OpenNMS Meridian, which can be exploited by an attacker to trick administrators into...
Opennms Group OpenNMS 跨站请求伪造漏洞
Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based OpenNMS Group Opennms Group. A security vulnerability exists in OpenNMS Horizon that stems from the lack of CSRF protection and failure to validate existing usernames whe...
Opennms Group OpenNMS 跨站脚本漏洞
Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based OpenNMS Group Opennms Group. A cross-site scripting vulnerability exists in OpenNMS Horizon, which can be exploited by an attacker to inject arbitrary scripts and trick...
Opennms Group OpenNMS 跨站脚本漏洞
Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based OpenNMS Group Opennms Group. A cross-site scripting vulnerability exists in OpenNMS Horizon that stems from incorrect validation checks performed on the input of the...
The vulnerability of the OpenNMS monitoring system, related to the occurrence of operations outside the buffer boundaries, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the OpenNMS monitoring system lies in the execution of operations beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
CVE-2021-3396
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...
CVE-2021-3396
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...
Remote code execution
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...
CVE-2021-3396
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...