Openc3

Cosmos

19 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2025-28388

Exploit
  • EPSS 0.53%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

9.8

CVE-2025-28386

Exploit
  • EPSS 0.92%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 23.06.2025 14:06:04

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

9.1

CVE-2025-28384

Exploit
  • EPSS 0.89%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

7.5

CVE-2025-28382

Exploit
  • EPSS 0.89%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

7.5

CVE-2025-28381

Exploit
  • EPSS 0.45%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.

6.1

CVE-2025-28380

Exploit
  • EPSS 0.29%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 15:15:37

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

6.5

CVE-2024-47529

Exploit
  • EPSS 0.34%
  • Veröffentlicht 02.10.2024 20:15:11
  • Zuletzt bearbeitet 13.11.2024 17:15:46

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password suscept...

6.5

CVE-2024-46977

  • EPSS 0.91%
  • Veröffentlicht 02.10.2024 20:15:11
  • Zuletzt bearbeitet 31.10.2024 14:15:05

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions...

6.1

CVE-2024-43795

  • EPSS 0.46%
  • Veröffentlicht 02.10.2024 20:15:10
  • Zuletzt bearbeitet 31.10.2024 14:15:05

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note...