OpenNMS Detection (HTTP)

HTTP based detection of OpenNMS. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/...

OpenNMS < 14.0.3 Multiple Vulnerabilities

OpenNMS is prone to multiple vulnerabilities. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenNMS Default Password Vulnerability

OpenNMS is the U.S. OpenNMS company's set of enterprise-class, Java/XML-based distributed network and system monitoring and management platform, the platform can display the status and configuration of various terminals and servers in the network. OpenNMS has a default password vulnerability. All...

CVE-2015-7856

OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials...

Default credentials

OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials...

CVE-2015-7856

OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials...

CVE-2015-7856

CVE-2015-7856 concerns OpenNMS and a default credential: the rtc account uses the password “rtc,” enabling remote access for an attacker who knows the credentials. The NVD entry lists a high base score (9.0+ system-generated, shown as 10.0 in this record) with network access, no authentication, a...

OpenNMS Authenticated XXE

OpenNMS is vulnerable to XML External Entity Injection in the Real-Time Console interface. Although this attack requires authentication, there are several factors that increase the severity of this vulnerability. 1. OpenNMS runs with root privileges, taken from the OpenNMS FAQ: "The difficulty wi...

opennms < 1.5.96 Multiple Vulnerabilities

No description provided by source. OpenNMS Multiple Vulnerabilities -------------------------------- BugSec | Security Advisory Moshe Ben-Abu | Security Expert Advisory URL PDF: http://www.bugsec.com/upfiles/OpenNMSMultipleVulnerabilities.pdf Vendor ------ OpenNMS Group – http://www.opennms.com...

OpenNMS 1.5.x j_acegi_security_check j_username Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31410/info OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser...

OpenNMS 1.5.x notification/list.jsp username Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31410/info OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser...

OpenNMS 1.5.x event/list filter Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/31410/info OpenNMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser...

OpenNMS 1.5.x HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31577/info OpenNMS is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to influence or misrepresent how web content is serve...

CVE-2014-3960

Multiple cross-site scripting XSS vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3960

OpenNMS before 1.12.7 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. The issue is documented across multiple sources (NVD, Red Hat advisory) with a confirmed fix in OpenNMS 1.12.7. Impa...

CVE-2014-3960

Multiple cross-site scripting XSS vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0936

Cross-site scripting XSS vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to...

Cross site scripting

Cross-site scripting XSS vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to...

CVE-2012-0936

This CVE affects OpenNMS: vulnerable in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1. The flaw is in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java, enabling cross-site scripting via the Username field during login. Root cause: XSS in th...