Onosproject Onos vulnerabilities
13 vulnerabilities
Known vulnerabilities in Onosproject Onos, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2023-30093onosproject · onos +1 moreonosproject onosA cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.CVSS6.1MediumEPSS0.49%PrioritiseCVE-2019-13624onosproject · onosonosproject onosIn ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.CVSS10.0CriticalEPSS1.91%PrioritiseCVE-2018-1000616onosproject · onosonosproject onosONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device.. This attack appear to be exploitable via network connectivity.CVSS9.8CriticalEPSS1.41%PrioritiseCVE-2018-1000615onosproject · onosonosproject onosONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in OVSDB component in ONOS that can result in An adversary can remotely crash OVSDB service ONOS controller via a normal switch.. This attack appear to be exploitable via the attacker should be able to control or forge a switch in the network..CVSS7.5HighEPSS1.16%PrioritiseCVE-2018-1000614onosproject · onosonosproject onosONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authentication.. This attack appear to be exploitable via crafted protocol message.CVSS9.8CriticalEPSS1.57%RoutineCVE-2018-12691onosproject · onosonosproject onosTime-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection.CVSS6.8MediumEPSS0.70%PrioritiseCVE-2017-13763onosproject · onos +1 moreonosproject onosONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.CVSS7.5HighEPSS1.06%RoutineCVE-2017-13762onosproject · onosonosproject onosONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.CVSS6.1MediumEPSS1.16%PrioritiseCVE-2015-7516onosproject · onosonosproject onosONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two Ethernet frames with ether_type Jumbo Frame (0x8870).CVSS7.8HighEPSS3.69%PrioritiseCVE-2017-1000081onosproject · onosonosproject onosLinux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.CVSS9.8CriticalEPSS2.99%PrioritiseCVE-2017-1000080onosproject · onosonosproject onosLinux foundation ONOS 1.9.0 allows unauthenticated use of websockets.CVSS7.5HighEPSS1.05%PrioritiseCVE-2017-1000079onosproject · onosonosproject onosLinux foundation ONOS 1.9.0 is vulnerable to a DoS.CVSS7.5HighEPSS1.30%RoutineCVE-2017-1000078onosproject · onosonosproject onosLinux foundation ONOS 1.9 is vulnerable to XSS in the device. registrationCVSS6.1MediumEPSS0.73%