HO
Product
Horizon
22
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 7Medium 15Low 0
Watch
Add Horizon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-40313 | 8.8 | Aug 17 | Disable BeanShell Interpreter Remote Server Mode Affected: before 32.0.2 |
| CVE-2021-25931 | 8.8 | May 20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;… Affected: 1.0 before 27.1.1 |
| CVE-2021-3396 | 8.8 | Feb 17 | OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control,… Affected: 16.0.0 through 27.0.3 |
| CVE-2020-11886 | 8.1 | Apr 17 | OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm Affected: before 25.2.1 |
| CVE-2023-40612 | 8.0 | Aug 23 | Authenticated XXE Injection Via The File Editor Affected: 31.0.8 before 32.0.2 |
| CVE-2023-40315 | 8.0 | Aug 17 | ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN Affected: 31.0.8 before 32.0.2 |
| CVE-2023-0872 | 8.0 | Aug 14 | ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users Affected: 31.0.8 before 32.0.2 |
| CVE-2023-0870 | 6.7 | Mar 22 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) Affected: before 31.0.6 |
| CVE-2023-0815 | 6.5 | Feb 23 | Plaintext Password Present in the Web logs Affected: before 31.0.4 |
| CVE-2023-40314 | 6.1 | Nov 16 | Cross-site scripting in bootstrap.jsp Affected: before 32.0.5 |
| CVE-2023-0871 | 6.1 | Aug 11 | An XML External Entity injection vulnerability Affected: 32.0.0 before 32.0.2; 31.0.8 |
| CVE-2023-0867 | 6.1 | Feb 23 | Multiple stored and reflected Cross-site Scripting in webapp Affected: before 31.0.4 |
| CVE-2023-0868 | 6.1 | Feb 23 | Stealing Cookies using Reflected XSS via graph results Affected: before 31.0.4 |
| CVE-2023-0869 | 6.1 | Feb 23 | Cross-site scripting in outage/list.htm Affected: before 31.0.4 |
| CVE-2023-0846 | 6.1 | Feb 22 | Unauthenticated, stored XSS in display of alarm reduction-key Affected: before 31.0.4 |
| CVE-2021-25934 | 5.4 | May 25 | In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;… Affected: 18.0.0 through 27.1.0 |
| CVE-2021-25935 | 5.4 | May 25 | In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;… Affected: 17.0.0 through 27.1.0 |
| CVE-2023-40312 | 5.2 | Aug 14 | Reflected XSS in multiple JSP files in opennms/opennms Affected: 31.0.8 before 32.0.2 |
| CVE-2023-40311 | 4.8 | Aug 14 | Stored XSS in multiple JSP files in opennms/opennms Affected: 31.0.8 before 32.0.2 |
| CVE-2021-25933 | 4.8 | May 20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;… Affected: 1.0 before 27.1.1 |
| CVE-2021-25929 | 4.8 | May 20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;… Affected: 1.0 before 27.1.1 |
| CVE-2021-25930 | 4.3 | May 20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1;… Affected: 1.0 before 27.1.1 |
Showing 22