Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Cosmos
(Openc3)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 10 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2025-06-13 | CVE-2025-28386 | A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file. | Cosmos | N/A | ||
| 2025-06-13 | CVE-2025-28380 | A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. | Cosmos | N/A | ||
| 2025-06-13 | CVE-2025-28381 | A credential leak in OpenC3 COSMOS v6.0.0 allows attackers to access service credentials as environment variables stored in all containers. | Cosmos | N/A | ||
| 2025-06-13 | CVE-2025-28382 | An issue in the openc3-api/tables endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal. | Cosmos | N/A | ||
| 2025-06-13 | CVE-2025-28384 | An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal. | Cosmos | N/A | ||
| 2025-06-13 | CVE-2025-28388 | OpenC3 COSMOS v6.0.0 was discovered to contain hardcoded credentials for the Service Account. | Cosmos | N/A | ||
| 2025-06-13 | CVE-2025-28389 | Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. | Cosmos | N/A | ||
| 2024-10-02 | CVE-2024-47529 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition. | Cosmos | 6.5 | ||
| 2024-10-02 | CVE-2024-43795 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition. | Cosmos | 6.1 | ||
| 2024-10-02 | CVE-2024-46977 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0. | Cosmos | 6.5 |