403 matches found
JavaUnserializeExploits
JavaUnserializeExploits Scripts de Python y petición HTTP referenciados en la entrada de blog ¿Qué tienen en común WebLogic, WebSphere, JBoss, Jenkins, OpenNMS y su aplicación? Esta vulnerabilidad en http://foxglovesecurity.com...
JavaUnserializeExploits
JavaUnserializeExploits Scripts de Python y peticiones HTTP referenciados en la publicación del blog What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability at http://foxglovesecurity.com...
serialator
serialator Script en Python para explotar CVE-2015-4852. Descripción Durante una reciente intervención, descubrí que Nessus ahora explotaba activamente vulnerabilidades para su confirmación. Cuando revisé el script nasl asociado, encontré que el payload era lo suficientemente genérico como para...
CVE-2026-89089
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-19596
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
EUVD-2026-75729
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-89089
A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-89054
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
EUVD-2026-75725
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-19596
An XML External Entity (XXE) vulnerability in the XML collector of OpenNMS Meridian and Horizon allows an attacker who can control the XML response collected by OpenNMS (e.g., via a compromised monitored host or HTTP man-in-the-middle) to read files accessible to the OpenNMS service account, incl...
CVE-2026-19596 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-19596 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-19596 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
EUVD-2026-75707
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054
CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...