CVE-2019-13624

In ONOS 1.15.0, the file apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command, indicating a potential command-injection flaw in the web/yang component. The connected documents confirm the affec...

CVE-2023-30093

CVE-2023-30093 is a cross-site scripting (XSS) vulnerability affecting Open Networking Foundation ONOS, from version v1.9.0 through v2.7.0. The issue enables execution of arbitrary web scripts/HTML via a crafted payload injected into the url parameter of the API documentation dashboard. The provi...

CVE-2017-13763

CVE-2017-13763 affects ONOS versions 1.8.0, 1.9.0, and 1.10.0. The root cause is lack of an upper bound on memory allocation for Netty payloads, i.e., Netty payload size is not limited. This has been linked to a denial-of-service risk on ONOS clusters (e.g., nodes timing out when connecting to th...

CVE-2017-1000078

ONOS 1.9 is affected by a cross-site scripting (XSS) vulnerability in the device registration component. The issue is documented across multiple sources (e.g., NVD CVE-2017-1000078) with CVSS metrics indicating a network-accessible flaw requiring user interaction (UI:R) and resulting in partial i...

CVE-2017-1000079

The provided connected documents confirm a denial-of-service vulnerability in Linux Foundation ONOS 1.9.0 (CVE-2017-1000079). Details explicitly present: affected product (ONOS 1.9.0), vulnerability class (DoS), and vendor/repository context. The CNVD entry states a DoS exists; NVD data lists CVS...

CVE-2017-1000080

CVE-2017-1000080 affects Linux Foundation ONOS 1.9.0. The vulnerability allows unauthenticated use of the websocket protocol, enabling an attacker to interact with ONOS WS endpoints without authentication. Associated sources (CNVD-2017-19578, NVD entry) describe exploitation as unauthenticated WS...

CVE-2018-1000614

CVE-2018-1000614 affects ONOS Controller version 1.13.1 and earlier. The XML External Entity (XXE) vulnerability is in providers/netconf/alarm/NetconfAlarmTranslator.java, allowing a remote, unauthenticated attacker to launch XXE attacks via crafted protocol messages. CVSSv3 base score 9.8 (CRITI...

CVE-2018-1000615

CVE-2018-1000615 affects ONOS Controller (versions

CVE-2018-1000616

CVE-2018-1000616 affects ONOS controller versions 1.13.1 and earlier. The vulnerability is a XML External Entity (XXE) flaw in XmlConfigParser.loadxml() that can enable remote XXE attacks over network via an OpenConfig Terminal Device. Multiple sources (including Red Hat, Veracode, OSV, NVD/CVE r...

CVE-2017-1000081

CVE-2017-1000081 affects Linux Foundation ONOS 1.9.0 and is due to unauthenticated upload of applications (.oar), enabling remote code execution. Primary sources (NVD) cite high/critical impacts (CVSSv2: 7.5/Partial partial integrity and availability; CVSSv3.1: 9.8 with high impact and network at...

CVE-2017-13762

CVE-2017-13762 affects ONOS versions 1.8.0, 1.9.0, and 1.10.0 and is described as a cross-site scripting (XSS) vulnerability. The connected sources consistently state that these ONOS releases are vulnerable to XSS (e.g., NVD, Red Hat, CNVD, OSV). The exact root cause, affected component/file, exp...

CVE-2015-7516

CVE-2015-7516 affects ONOS before 1.5.0 when using the ifwd app. A remote attacker can cause a denial of service by sending two Ethernet frames with ether_type 0x8870, triggering a NULL pointer dereference and switch disconnect. The available documents describe the impact as DoS but do not specif...

CVE-2018-12691

The vulnerability CVE-2018-12691 affects the org.onosproject.acl component in ONOS versions up to v1.13. It is caused by a TOCTOU race condition that allows an attacker to bypass network access control by sending data plane packets, enabling bypass of ACL checks. The available documents consisten...