Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: The OpenNMS Group Horizon 31.0.4 Clear all filters
TI-2023-00773 CVE-2023-0815 · GHSA-9xpj-mvp2-3943

Plaintext Password Present in the Web logs

Priority LOW 31

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug.

CVSS 3.1MEDIUM 6.8 Adjacent network Low privileges No interaction EPSS 0.00633 Published 2023-02-23 Fixed in 31.0.4 CWE-532
TI-2023-00822 CVE-2023-0867 · GHSA-mjv2-6jv4-vrg7

Multiple stored and reflected Cross-site Scripting in webapp

Priority LOW 30

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information.

CVSS 3.1MEDIUM 6.7 Adjacent network Low privileges User interaction EPSS 0.00424 Published 2023-02-23 Fixed in 2023.1.0, 31.0.4 CWE-20
TI-2023-00824 CVE-2023-0869 · GHSA-7v39-jjj6-j4j4

Improper input validation in OpenNMS Group Meridian

Priority LOW 27

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00408 Published 2023-02-23 Fixed CWE-20