Issues

Update Snakeyaml for indirect dependencies

Update guava version to latest to address CVE-2023-2976

Update to Netty 4

Integrate hibernate-core related patch from Debian

Update grpc to to the next version to address CVEs

Back-port Angular evaluation prevention in non-Angular fields to foundation-2020

Polymorphic Typing issue in FasterXML jackson-databind

Polymorphic Typing issue in FasterXML jackson-databind

Reflected XSS in multiple JSP files in opennms/opennms

XXE injection via  /rtc/post using the default rtc credentials

Prevent Angular evaluation of strings enclosed by two curly braces in non-Angular form-fields and output

upgrade Jackson code to all use Jackson v2

Cross site scripting - Reflected

Support -> System Report exposes credentials in plain text

Reflected XSS in webapp notice wizard

Backport Security Issues from Last Month

Reflected XSS reported 2021-03-31 (update summary after disclosure)

Password in collectd.log file

XSS in notification wizard

opennms user credentials wrongly exposed

Reflected XSS vulnerability in notification/detail.jsp and outage/detail.htm

IOActive: Reflected Cross-site Scripting in alarm/list.htm display Parameter

IOActive: Reflected Cross-site Scripting in admin/thresholds/index.htm filterField and Other Parameters

IOActive: Reflected Cross-site Scripting in userGroupView/roles roleDescr and Other Parameters

IOActive: Reflected Cross-site Scripting in heatmap/outages heatmap Parameter

IOActive: Cross-Site Scripting in createFavorite filter Parameter

Multiple XSS vulnerabilities in OpenNMS webapp

XSS vulnerability on node error page

Poodle exploit: exclude SSLv3 in example Jetty HTTPS configuration (thanks to David Gerdes, University of Illinois)

Security: downloadReport allow download and view any file in filesystem

Two XSS vulnerabilities in webapp

Any authenticated user can use the snmpConfig ReST service

XSS vulnerability in OpenNMS web UI

Prototype Pollution in handlebars

XSS via JQLite DOM manipulation functions in AngularJS

Prototype Pollution in lodash.merge

Prototype Pollution in lodash.merge

Denial of Service in node-sass

Denial of Service in handlebars

Arbitrary Code Execution in handlebars

Prototype Pollution in handlebars

Arbitrary Code Execution in handlebars

Regular Expression Denial of Service in npm-user-validate

ReDOS vulnerabities: multiple grammars

Improper Privilege Management in shelljs

Memory Exposure in tunnel-agent

Memory Exposure in concat-stream

Code Injection in js-yaml

Denial of Service in js-yaml