Reproduced and fixed the XSS vuln in the Outages List page.

A lot of the urls/params in the spreadsheet will output the given HTML as part of an error message. Is that what's triggering the XSS detection? Examples below.

POST http://localhost:8980/opennms/api/v2/geolocation
Accept: application/json
Cookie: ***
Authorization: ***
Content-Type: application/json

{
"strategy": "Alarms",
"severityFilter": "INDETERMINATE",
"includeAcknowledgedAlarms": "<script>alert(document.cookie)</script>"
}

Response body:

Can not construct instance of boolean from String value '<script>alert(document.cookie)</script>': only "true" or "false" recognized
at [Source: org.apache.cxf.transport.http.AbstractHTTPDestination$1@10ff08a1; line: 3, column: 36] (through reference chain: org.opennms.web.rest.v2.GeolocationQueryDTO["includeAcknowledgedAlarms"])

Or like this:

GET http://localhost:8980/opennms/rest/nodes/2/snmpinterfaces?limit=<script>alert(document.cookie)</script>
Accept: application/json, text/plain, /
Cookie: ***
Authorization: ***

Response body:

For input string: "<script>alert(document.cookie)</script>"

Item marked as security-moderate. Normally this would be considered a high risk item, however, Meridian is usually installed in a secure environment. 

Attaching the Endpoints  found vulnernable to XSS reflected. These needs to checked and remediated. 

We already do some amount of XSS mitigation at the global level as well as in individual UI code – do you have specific concerns or subsystems where you have found issues?