CVE-2015-7856

OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials...

CVE-2015-7856

CVE-2015-7856 concerns OpenNMS and a default credential: the rtc account uses the password “rtc,” enabling remote access for an attacker who knows the credentials. The NVD entry lists a high base score (9.0+ system-generated, shown as 10.0 in this record) with network access, no authentication, a...

OpenNMS Authenticated XXE

OpenNMS is vulnerable to XML External Entity Injection in the Real-Time Console interface. Although this attack requires authentication, there are several factors that increase the severity of this vulnerability. 1. OpenNMS runs with root privileges, taken from the OpenNMS FAQ: "The difficulty...

OpenNMS 1.5.x j_acegi_security_check j_username Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31410/info OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser...

opennms < 1.5.96 Multiple Vulnerabilities

No description provided by source. OpenNMS Multiple Vulnerabilities -------------------------------- BugSec | Security Advisory Moshe Ben-Abu | Security Expert Advisory URL PDF: http://www.bugsec.com/upfiles/OpenNMSMultipleVulnerabilities.pdf Vendor ------ OpenNMS Group – http://www.opennms.com...

OpenNMS 1.5.x event/list filter Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31410/info OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser...

OpenNMS 1.5.x HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31577/info OpenNMS is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to influence or misrepresent how web content is serve...

OpenNMS 1.5.x notification/list.jsp username Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31410/info OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser...

CVE-2014-3960

Multiple cross-site scripting XSS vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3960

OpenNMS before 1.12.7 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. The issue is documented across multiple sources (NVD, Red Hat advisory) with a confirmed fix in OpenNMS 1.12.7. Impa...

CVE-2014-3960

Multiple cross-site scripting XSS vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0936

Cross-site scripting XSS vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to...

Cross site scripting

Cross-site scripting XSS vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to...

CVE-2012-0936

Cross-site scripting XSS vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to...

CVE-2012-0936

This CVE affects OpenNMS: vulnerable in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1. The flaw is in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java, enabling cross-site scripting via the Username field during login. Root cause: XSS in th...

CVE-2008-6095

Cross-site scripting XSS vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewName parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewName parameter...

CVE-2008-6095

CVE-2008-6095 is a cross-site scripting (XSS) vulnerability in OpenNMS version 1.5.94, exploitable via the viewName parameter in surveillanceView.htm. ATT&CK/impact details are limited to the ability of remote attackers to inject arbitrary web script or HTML, with the NVD entry listing a Medium b...

CVE-2008-6095

Cross-site scripting XSS vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewName parameter...