Advisories · Technology
The OpenNMS Group Horizon.
Every CVE that names The OpenNMS Group Horizon among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
OpenNMS denial of service via XML entity expansion
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
OpenNMS REST authorization bypass via non-canonical HTTP method
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- Broken access control
- CWE-204
- CVSS 6.5 Medium
OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- SQL injection
- CVSS 5.9 Medium
OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- XML external entities (XXE)
- CVSS 8.2 High
OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
- The OpenNMS Group Horizon
- Broken access control
- CVSS 4.3 Medium
OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- Broken access control
- CVSS 5.4 Medium
OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- Code injection
- CVSS 6.9 Medium
SQLi in OpenNMS Horizon and Meridian
- The OpenNMS Group Horizon
- The OpenNMS Group Meridian
- SQL injection
- CVSS 6.9 Medium
Stored XSS in multiple 33.0.8files in opennms/opennms
- The OpenNMS Group Horizon
- The OpenNMS Group Meridian
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Authenticated XXE Injection Via The File Editor
- The OpenNMS Group Horizon
- The OpenNMS Group Meridian
- Other injection