Vulnerabilities (CVE)

Filtered by vendor Opennms Subscribe
Filtered by product Meridian
Total 23 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-25933 1 Opennms 2 Horizon, Meridian 2024-02-28 3.5 LOW 4.8 MEDIUM
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.
CVE-2021-3396 1 Opennms 3 Horizon, Meridian, Newts 2024-02-28 6.5 MEDIUM 8.8 HIGH
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
CVE-2020-11886 1 Opennms 2 Horizon, Meridian 2024-02-28 5.5 MEDIUM 8.1 HIGH
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.