CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 심각9.8 |
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command. |
| 17/07/2019 |
| CVE-2018-1000616 | 심각9.8 | ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can remotely launch XXE attacks on ONOS controller via an OpenConfig Terminal Device | 09/07/2018 |
| CVE-2018-1000615 | 높음7.5 | ONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in OVSDB component in ONOS that can result in An adversary can remotely crash OVSDB service ONOS controller via a normal switch.. This attack appear to be exploitable via the attacker should be able to control or | 09/07/2018 |
| CVE-2018-1000614 | 심각9.8 | ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authenticatio | 09/07/2018 |
| CVE-2018-12691 | 보통6.8 | Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection. | 05/07/2018 |
| CVE-2017-13763 | 높음7.5 | ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited. | 30/08/2017 |
| CVE-2017-13762 | 보통6.1 | ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS. | 30/08/2017 |
| CVE-2015-7516 | 높음7.5 | ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two Ethernet frames with ether_type Jumbo Frame (0x8870). | 24/08/2017 |
| CVE-2017-1000081 | 심각9.8 | Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution. | 17/07/2017 |
| CVE-2017-1000080 | 높음7.5 | Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets. | 17/07/2017 |
| CVE-2017-1000079 | 높음7.5 | Linux foundation ONOS 1.9.0 is vulnerable to a DoS. | 17/07/2017 |
| CVE-2017-1000078 | 보통6.1 | Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration | 17/07/2017 |