CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.

• CWE-502

• https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1Release Notes
• https://issues.opennms.org/browse/NMS-12673Vendor Advisory
• https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/Release Notes, Vendor Advisory
• https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/Release Notes, Vendor Advisory
• https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/Release Notes, Vendor Advisory
• https://github.com/OpenNMS/opennms/releases/tag/opennms-26.0.1-1Release Notes
• https://issues.opennms.org/browse/NMS-12673Vendor Advisory
• https://www.opennms.com/en/blog/2020-04-29-opennms-horizon-26-0-1-luchador-released/Release Notes, Vendor Advisory
• https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2018-1-18-wildfire-released/Release Notes, Vendor Advisory
• https://www.opennms.com/en/blog/2020-04-29-opennms-meridian-2019-1-6-europa-released/Release Notes, Vendor Advisory

Published

May 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12754An issue was discovered on LG mobile devices with Android OS…7.8
• CVE-2020-12755fishProtocol::establishConnection in fish/fish.cpp in KDE ki…3.3
• CVE-2020-12757HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when c…9.8
• CVE-2020-12758HashiCorp Consul and Consul Enterprise could crash when conf…7.5
• CVE-2020-12759Zulip Server before 2.1.5 allows reflected XSS via the Dropb…6.1
• CVE-2020-1276An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12761modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer …9.1
• CVE-2020-12762json-c through 0.14 has an integer overflow and out-of-bound…7.8
• CVE-2020-12763TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vu…9.8
• CVE-2020-12764Gnuteca 3.8 allows file.php?folder=/&file= Directory Travers…5.3
• CVE-2020-12765Solis Miolo 2.0 allows index.php?module=install&action=view&…5.3
• CVE-2020-12766Gnuteca 3.8 allows action=main:search:simpleSearch SQL Injec…9.8