Approved changes feed: RSS · Atom
cpe:2.3:a:n/a:opennms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | N/A (22f567d3-1203-528c-8f0e-3eb9c2f6ca78) |
|---|---|
| Product | Opennms (dd7df8cf-a139-52a0-b99e-4745ce85d0f7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-25935 |
vulnerable | 2026-06-08 05:30:41.739441 |
Details available
In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.
Published: 2021-05-25T18:32:59.000Z
Updated: 2024-08-03T20:11:28.488Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25934 |
vulnerable | 2026-06-08 05:30:41.739002 |
Details available
In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
Published: 2021-05-25T18:42:29.000Z
Updated: 2024-08-03T20:11:28.482Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25933 |
vulnerable | 2026-06-08 05:30:41.738389 |
Details available
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.
Published: 2021-05-20T14:59:24.000Z
Updated: 2025-04-30T20:22:32.622Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25932 |
vulnerable | 2026-06-08 05:30:41.735784 |
Details available
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
Published: 2021-06-01T11:15:51.000Z
Updated: 2024-08-03T20:11:28.465Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25931 |
vulnerable | 2026-06-08 05:30:41.735276 |
Details available
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
Published: 2021-05-20T14:54:36.000Z
Updated: 2025-04-30T20:22:38.164Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25930 |
vulnerable | 2026-06-08 05:30:41.734597 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25929 |
vulnerable | 2026-06-08 05:30:41.732122 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.