Product by OpenNMS

    Horizon

    22 known vulnerabilities in Horizon (OpenNMS), 0 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Horizon (OpenNMS)
    HighCVE-2023-0872

    ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

    also in 3 other products

    		8.2
    HighCVE-2021-3396

    OpenNMS Meridian: Improper Access Control

    also in 1 other product

    		8.8
    HighCVE-2023-40315

    ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN

    also in 3 other products

    		5.3
    HighCVE-2020-11886

    OpenNMS Meridian: security vulnerability

    also in 1 other product

    		8.1
    HighCVE-2021-25931

    OpenNMS: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		8.8
    HighCVE-2023-40313

    Disable BeanShell Interpreter Remote Server Mode

    also in 3 other products

    		7.1
    MediumCVE-2023-40311

    Stored XSS in multiple JSP files in opennms/opennms

    also in 3 other products

    		6.7
    MediumCVE-2021-25934

    OpenNMS: Cross-Site Scripting (XSS)

    also in 1 other product

    		5.4
    MediumCVE-2023-40312

    Reflected XSS in multiple JSP files in opennms/opennms

    also in 3 other products

    		6.7
    MediumCVE-2021-25933

    OpenNMS: Cross-Site Scripting (XSS)

    also in 1 other product

    		4.8
    MediumCVE-2023-0815

    Plaintext Password Present in the Web logs

    also in 3 other products

    		6.8
    MediumCVE-2021-25929

    OpenNMS: Cross-Site Scripting (XSS)

    also in 1 other product

    		4.8
    MediumCVE-2021-25935

    OpenNMS: Cross-Site Scripting (XSS)

    also in 1 other product

    		5.4
    MediumCVE-2023-0846

    Unauthenticated, stored XSS in display of alarm reduction-key

    also in 3 other products

    		6.7
    MediumCVE-2023-0868

    Stealing Cookies using Reflected XSS via graph results

    also in 3 other products

    		6.7
    HighCVE-2023-0870

    Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)

    also in 3 other products

    		8.1
    MediumCVE-2023-0871

    An XML External Entity injection vulnerability

    also in 3 other products

    		5.4
    MediumCVE-2023-0867

    Multiple stored and reflected Cross-site Scripting in webapp

    also in 3 other products

    		6.7
    MediumCVE-2023-40314

    Cross-site scripting in bootstrap.jsp

    also in 3 other products

    		5.8
    MediumCVE-2021-25930

    OpenNMS: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		4.3
    MediumCVE-2023-0869

    Cross-site scripting in outage/list.htm

    also in 3 other products

    		5.8
    HighCVE-2023-40612

    Authenticated XXE Injection Via The File Editor

    also in 3 other products

    		5.3

    All products by OpenNMS