Xanlar Agamalizade

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings. The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

**Name of the Vulnerable Software and Affected Versions** WP Maps versions prior to 4.9.8 **Description** An issue exists in an AJAX action where the software fails to perform a capability check and does not validate a nonce (a unique token used to prevent replay attacks). This allows users with a Subscriber account to create an unlimited number of options in the database, which are then loaded on every page request. **Recommendations** Update WP Maps to version 4.9.8 or later.

**Name of the Vulnerable Software and Affected Versions** OpenNMS Meridian versions prior to 2024.3.12 OpenNMS Meridian versions prior to 2025.0.9 OpenNMS Horizon versions prior to 36.0.3 **Description** A JEXL expression sandbox bypass exists in the Measurements REST API. A low-privileged authenticated user can submit a crafted expression to escape the sandbox and load arbitrary Java classes on the server. This could allow an attacker to access confidential information and compromise system integrity. JEXL (Java Expression Language) is a powerful expression language used to evaluate dynamic expressions in Java applications. **Recommendations** Upgrade to Meridian 2024.3.12 or newer. Upgrade to Meridian 2025.0.9 or newer. Upgrade to Horizon 36.0.3 or newer. Ensure the software is installed within private networks and not directly accessible from the Internet.

**Name of the Vulnerable Software and Affected Versions** OpenClaude versions prior to 0.5.1 **Description** The MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent Cross-Site Request Forgery (CSRF) attacks, the server validates a `state` parameter against an internally stored value. A logic flaw in the order of conditionals allows an attacker to bypass this check by providing an `error` query parameter in the request. When the `error` parameter is present, the CSRF validation is skipped, and the server executes a cleanup function that shuts down the local server and terminates the user's active authentication session, resulting in a Denial of Service (DoS). **Recommendations** Update to version 0.5.1.