GCVE - cpe:2.3:a:onosproject:onos:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:onosproject:onos:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Onosproject (`5dc871a1-f838-589a-b263-0db9ab3ffb71`)
Product	Onos (`d30e10c8-943a-516e-89e2-7382b3932872`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/opennetworkinglab/onos`	purl2cpe	2026-06-01 10:11:42.011741

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-52726`	vulnerable	2026-06-08 06:17:55.625405	Details available Open Networking Foundation SD-RAN ONOS onos-ric-sdk-go 0.8.12 allows infinite repetition of the processing of an error (in the Subscribe function implementation for the subscribed indication stream). Published: 2024-04-29T00:00:00.000Z Updated: 2024-08-02T23:11:35.014Z Open on db.gcve.eu Reference links https://github.com/onosproject/onos-ric-sdk-go/issues/133	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-30093`	vulnerable	2026-06-08 06:02:43.831363	Details available A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard. Published: 2023-05-04T00:00:00.000Z Updated: 2025-01-29T20:46:44.046Z Open on db.gcve.eu Reference links https://www.edoardoottavianelli.it/CVE-2023-30093/ https://www.youtube.com/watch?v=jZr2JhDd_S8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-12691`	vulnerable	2026-06-08 05:10:41.886146	Details available Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection. Published: 2018-07-05T18:00:00.000Z Updated: 2024-08-05T08:45:00.678Z Open on db.gcve.eu Reference links https://gerrit.onosproject.org/#/c/18867/ https://wiki.onosproject.org/display/ONOS/Security+advisories	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000616`	vulnerable	2026-06-08 05:10:25.841947	Details available ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.. This attack appear to be exploitable via network connectivity. Published: 2018-07-09T20:00:00.000Z Updated: 2024-09-17T01:31:35.632Z Open on db.gcve.eu Reference links https://gerrit.onosproject.org/#/c/18894/ http://gms.cl0udz.com/Openconfig_xxe.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000615`	vulnerable	2026-06-08 05:10:25.841496	Details available ONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in OVSDB component in ONOS that can result in An adversary can remotely crash OVSDB service ONOS controller via a normal switch.. This attack appear to be exploitable via the attacker should be able to control or forge a switch in the network.. Published: 2018-07-09T20:00:00.000Z Updated: 2024-09-16T20:16:40.789Z Open on db.gcve.eu Reference links http://gms.cl0udz.com/OVSDB_DOS.pdf https://gerrit.onosproject.org/#/c/18926/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000614`	vulnerable	2026-06-08 05:10:25.840952	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-7516`	vulnerable	2026-06-08 05:07:01.229532	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.