GCVE - cpe:2.3:a:opennms:opennms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:opennms:opennms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Opennms (`c445ff86-e9be-5f09-b7b1-bbd0bc1ed391`)
Product	Opennms (`2a6119e4-5a63-59c7-bc05-2b70ad55d510`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/opennms/opennms`	purl2cpe	2026-06-01 10:13:28.174963
`pkg:sourceforge/opennms`	purl2cpe	2026-06-01 10:13:28.174965

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-25932`	vulnerable	2026-06-08 05:30:41.737769	Details available In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database. Published: 2021-06-01T11:15:51.000Z Updated: 2024-08-03T20:11:28.465Z Open on db.gcve.eu Reference links https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25932 https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6556`	vulnerable	2026-06-08 05:08:02.754405	OpenNMS Stored XSS via SNMP Agent Data HIGH (7.1) OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016. Published: 2022-06-15T18:35:47.512Z Updated: 2024-09-16T16:43:02.484Z Open on db.gcve.eu Reference links https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/ https://github.com/OpenNMS/opennms/pull/1019	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6555`	vulnerable	2026-06-08 05:08:02.753979	OpenNMS Stored XSS via SNMP Trap Alerts HIGH (7.1) OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in version 18.0.2, released on September 20, 2016. Published: 2022-06-15T18:35:43.500Z Updated: 2024-09-17T01:41:54.993Z Open on db.gcve.eu Reference links https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/ https://github.com/OpenNMS/opennms/pull/1019	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3960`	vulnerable	2026-06-08 05:05:43.660423	Details available Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2014-06-04T14:00:00.000Z Updated: 2024-09-17T00:20:54.889Z Open on db.gcve.eu Reference links http://www.opennms.org/documentation/ReleaseNotesStable.html#opennms-1.12.7 http://www.securityfocus.com/bid/67774 http://secunia.com/advisories/58748	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.