Unscored severity · published Jun 4, 2014
CVE-2014-3960
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
1.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.12.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opennms · Opennms
through 1.12.6; 1.9.0; 1.9.1; 1.9.2; 1.9.3; 1.9.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3960
secunia.com
http://secunia.com/advisories/58748
www.opennms.org
http://www.opennms.org/documentation/ReleaseNotesStable.html#opennms-1.12.7
www.securityfocus.com
http://www.securityfocus.com/bid/67774
More from Opennms
9.8
CVE-2020-1652
OpenNMS is accessible via port 9443
6.1
CVE-2016-6556
OpenNMS Stored XSS via SNMP Agent Data
6.1
CVE-2016-6555
OpenNMS Stored XSS via SNMP Trap Alerts
5.4
CVE-2021-25932
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;…
–
CVE-2015-7856
OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials