CVE-2017-13762

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.onosproject.org/#/c/14031/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14049/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14050/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14066/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14067/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14069/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14148/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14170/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14179/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14182/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14031/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14049/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14050/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14066/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14067/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14069/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14148/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14170/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14179/Issue Tracking, Vendor Advisory
https://gerrit.onosproject.org/#/c/14182/Issue Tracking, Vendor Advisory

Timeline

Published: Aug 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-137637.5ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.CVE-2017-137647.5In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c b CVE-2017-137657.5In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. This was address CVE-2017-137667.5In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/pro CVE-2017-137677.5In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/disse CVE-2017-137686.5Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perfor CVE-2017-137696.5The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buff CVE-2017-13774.3IBM Runbook Automation reveals sensitive information in error messages that could be used in further attacks against the system. IBM X-Force CVE-2017-137719.8Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which CVE-2017-137728.8Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arb CVE-2017-137747.8Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors.CVE-2017-137756.5GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may