OpenNMS records

30 published records for vendor opennms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 2 · 6.7%
Pre-auth RCE: 1
With a fix record: 73.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

30 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2015-7856No exploit	OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledopennms · opennms · CWE-255 Pre-auth Hard-coded credentials	Critical10.0	—	2.4%	Oct 16, 2015
40Plan	CVE-2023-0872Weaponized	ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/usersopennms · horizon · CWE-269	High8.0	—	3.3%	Aug 14, 2023
40Plan	CVE-2023-40315Weaponized	ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMINopennms · horizon · CWE-863 Broken access control (IDOR)	High8.0	—	2.8%	Aug 17, 2023
39Monitor	CVE-2020-1652No exploit	Junos Space: OpenNMS is accessible via port 9443opennms · opennms · CWE-213 Pre-auth	Critical9.8	—	0.7%	Jul 17, 2020
36Monitor	CVE-2020-12760No exploit	An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7.opennms · opennms horizon · CWE-502 RCE Deserialization	High8.8	—	3.4%	May 11, 2020
36Monitor	CVE-2021-3396No exploit	OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <opennms · horizon RCE	High8.8	—	2.3%	Feb 17, 2021
35Monitor	CVE-2023-40313No exploit	Disable BeanShell Interpreter Remote Server Modeopennms · horizon · CWE-94 pre-auth RCE	High8.8	—	0.7%	Aug 17, 2023
35Monitor	CVE-2021-25931No exploit	In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through opennms · horizon · CWE-352 Pre-auth CSRF	High8.8	—	0.7%	May 20, 2021
32Monitor	CVE-2020-11886No exploit	OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCopennms · horizon · CWE-89 SQL injection	High8.1	—	1.3%	Apr 17, 2020
32Monitor	CVE-2023-40612No exploit	Authenticated XXE Injection Via The File Editoropennms · horizon · CWE-91 XXE	High8.0	—	0.4%	Aug 23, 2023
26Monitor	CVE-2023-0815No exploit	Plaintext Password Present in the Web logsopennms · horizon · CWE-532 Info leak	Medium6.5	—	0.6%	Feb 23, 2023
26Monitor	CVE-2023-0870No exploit	Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)opennms · horizon · CWE-352 CSRF	Medium6.7	—	0.3%	Mar 22, 2023
24Monitor	CVE-2016-6555No exploit	OpenNMS Stored XSS via SNMP Trap Alertsopennms · opennms · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Sep 24, 2021
24Monitor	CVE-2016-6556No exploit	OpenNMS Stored XSS via SNMP Agent Dataopennms · opennms · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Sep 24, 2021
24Monitor	CVE-2023-0871No exploit	An XML External Entity injection vulnerabilityopennms · horizon · CWE-611 Pre-auth XXE	Medium6.1	—	0.5%	Aug 11, 2023
24Monitor	CVE-2023-0846No exploit	Unauthenticated, stored XSS in display of alarm reduction-keyopennms · horizon · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Feb 22, 2023
24Monitor	CVE-2023-0868No exploit	Stealing Cookies using Reflected XSS via graph resultsopennms · horizon · CWE-20 Pre-auth XSS	Medium6.1	—	0.4%	Feb 23, 2023
24Monitor	CVE-2023-40314No exploit	Cross-site scripting in bootstrap.jspopennms · horizon · CWE-20 Pre-auth XSS	Medium6.1	—	0.4%	Nov 16, 2023
24Monitor	CVE-2023-0867No exploit	Multiple stored and reflected Cross-site Scripting in webappopennms · horizon · CWE-20 Pre-auth XSS	Medium6.1	—	0.4%	Feb 23, 2023
24Monitor	CVE-2023-0869No exploit	Cross-site scripting in outage/list.htmopennms · horizon · CWE-20 Pre-auth XSS	Medium6.1	—	0.4%	Feb 23, 2023
21Monitor	CVE-2021-25934No exploit	In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meopennms · horizon · CWE-79 XSS	Medium5.4	—	1.0%	May 25, 2021
21Monitor	CVE-2021-25932No exploit	In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through opennms · meridian · CWE-79 XSS	Medium5.4	—	0.9%	Jun 1, 2021
21Monitor	CVE-2021-25935No exploit	In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meopennms · horizon · CWE-79 XSS	Medium5.4	—	0.9%	May 25, 2021
20Monitor	CVE-2023-40312No exploit	Reflected XSS in multiple JSP files in opennms/opennmsopennms · horizon · CWE-79 Pre-auth XSS	Medium5.2	—	0.6%	Aug 14, 2023
19Monitor	CVE-2021-25933No exploit	In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through opennms · horizon · CWE-79 XSS	Medium4.8	—	1.0%	May 20, 2021

CVE-2015-7856
41Plan
OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowled
CriticalCVSS 10.0No exploitEPSS 2%
- Pre-auth
- Hard-coded credentials
opennms · opennmsOct 16, 2015
CVE-2023-0872
40Plan
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
HighCVSS 8.0WeaponizedEPSS 3%
opennms · horizonAug 14, 2023
CVE-2023-40315
40Plan
ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN
HighCVSS 8.0WeaponizedEPSS 2%
- Broken access control (IDOR)
opennms · horizonAug 17, 2023
CVE-2020-1652
39Monitor
Junos Space: OpenNMS is accessible via port 9443
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
opennms · opennmsJul 17, 2020
CVE-2020-12760
36Monitor
An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7.
HighCVSS 8.8No exploitEPSS 3%
- RCE
- Deserialization
opennms · opennms horizonMay 11, 2020
CVE-2021-3396
36Monitor
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <
HighCVSS 8.8No exploitEPSS 2%
- RCE
opennms · horizonFeb 17, 2021
CVE-2023-40313
35Monitor
Disable BeanShell Interpreter Remote Server Mode
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
opennms · horizonAug 17, 2023
CVE-2021-25931
35Monitor
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
opennms · horizonMay 20, 2021
CVE-2020-11886
32Monitor
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addC
HighCVSS 8.1No exploitEPSS 1%
- SQL injection
opennms · horizonApr 17, 2020
CVE-2023-40612
32Monitor
Authenticated XXE Injection Via The File Editor
HighCVSS 8.0No exploitEPSS 0%
- XXE
opennms · horizonAug 23, 2023
CVE-2023-0815
26Monitor
Plaintext Password Present in the Web logs
MediumCVSS 6.5No exploitEPSS 0%
- Info leak
opennms · horizonFeb 23, 2023
CVE-2023-0870
26Monitor
Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)
MediumCVSS 6.7No exploitEPSS 0%
- CSRF
opennms · horizonMar 22, 2023
CVE-2016-6555
24Monitor
OpenNMS Stored XSS via SNMP Trap Alerts
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · opennmsSep 24, 2021
CVE-2016-6556
24Monitor
OpenNMS Stored XSS via SNMP Agent Data
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · opennmsSep 24, 2021
CVE-2023-0871
24Monitor
An XML External Entity injection vulnerability
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XXE
opennms · horizonAug 11, 2023
CVE-2023-0846
24Monitor
Unauthenticated, stored XSS in display of alarm reduction-key
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · horizonFeb 22, 2023
CVE-2023-0868
24Monitor
Stealing Cookies using Reflected XSS via graph results
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · horizonFeb 23, 2023
CVE-2023-40314
24Monitor
Cross-site scripting in bootstrap.jsp
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · horizonNov 16, 2023
CVE-2023-0867
24Monitor
Multiple stored and reflected Cross-site Scripting in webapp
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · horizonFeb 23, 2023
CVE-2023-0869
24Monitor
Cross-site scripting in outage/list.htm
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opennms · horizonFeb 23, 2023
CVE-2021-25934
21Monitor
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through me
MediumCVSS 5.4No exploitEPSS 1%
- XSS
opennms · horizonMay 25, 2021
CVE-2021-25932
21Monitor
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through
MediumCVSS 5.4No exploitEPSS 0%
- XSS
opennms · meridianJun 1, 2021
CVE-2021-25935
21Monitor
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through me
MediumCVSS 5.4No exploitEPSS 0%
- XSS
opennms · horizonMay 25, 2021
CVE-2023-40312
20Monitor
Reflected XSS in multiple JSP files in opennms/opennms
MediumCVSS 5.2No exploitEPSS 0%
- Pre-auth
- XSS
opennms · horizonAug 14, 2023
CVE-2021-25933
19Monitor
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through
MediumCVSS 4.8No exploitEPSS 1%
- XSS
opennms · horizonMay 20, 2021