CVE-2021-3396

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

Tarus Balog OpenNMS Meridian Security Vulnerability

Tarus Balog OpenNMS Meridian is an application from Canary Tarus Balog, Inc. It provides for building network monitoring solutions. A security vulnerability exists in OpenNMS Meridian that arises from a network system or product that does not properly restrict access to resources from unauthorize...

Exploit for Deserialization of Untrusted Data in Redhat Data_Grid

This repository contains a collection of Python scripts for exploiting Java deserialization vulnerabilities in various applications, including Cisco Prime Infrastructure, JBoss, Jenkins, and OpenNMS. The scripts use the ysoserial tool to generate the payload. The scripts can be categorized into...

CVE-2020-1652

OpenNMS is accessible via port 9443...

CVE-2020-1652

OpenNMS is accessible via port 9443...

Design/Logic Flaw

OpenNMS is accessible via port 9443...

CVE-2020-1652

CVE-2020-1652 affects Junos Space and Junos Space Security Director running OpenNMS; vulnerable component relates to OpenNMS accessible via port 9443. Exploitation could allow an attacker to access OpenNMS on affected Junos Space products prior to version 20.1R1 and Security Director prior to 20....

CVE-2020-1652 Junos Space: OpenNMS is accessible via port 9443

OpenNMS is accessible via port 9443...

OpenNMS Group OpenNMS Code Issues Vulnerabilities

OpenNMS Group OpenNMS is an open source enterprise network monitoring and network management platform from OpenNMS Group, Inc. OpenNMS Horizon and Meridian are different versions of OpenNMS. A security vulnerability exists in the ActiveMQ channel configuration in OpenNMS Horizon versions prior to...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

Deserialization of untrusted data

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

This CVE concerns OpenNMS Horizon (before 26.0.1) and Meridian (before 2018.1.19 and before 2019.1.7) where ActiveMQ channel configuration enabled arbitrary Java deserialization (ActiveMQ Minion payload deserialization), enabling remote code execution for any authenticated channel user. Affected ...

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

Sql injection

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

CVE-2020-11886

OpenNMS Horizon and Meridian are affected by CVE-2020-11886 due to a HQL Injection vulnerability in the NodeListController (element/nodeList.htm) reachable via snmpParms. The issue allows adding criteria through snmpParm or snmpParmValue, enabling injection in the HQL query. Affected versions are...

CVE-2020-11886

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

The vulnerability of the OpenNMS monitoring system, a network management platform from Juniper Networks Junos Space, arises due to insufficient protection of the website structure. This allows attackers to disclose protected information or perform actions on behalf of the administrator.

The vulnerability of OpenNMS, which is included in the Juniper Networks Junos Space network management platform, stems from insufficient protection of the website structure. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or carry out actions on behalf ...