853 matches found
CVE-2025-28389
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...
CVE-2025-28388
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...
OpenC3 COSMOS 安全漏洞
OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to v6.0.2 that stems from the use of hard-coded credentials for service accounts...
OpenC3 COSMOS 安全漏洞
OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS version v6.0.0 that stems from a weak password requirement and could lead to a brute force attack...
PT-2025-25416
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue is related to hardcoded credentials for the Service Account. Recommendations For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique, secu...
PT-2025-25411
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Recommendations For OpenC3 COSMOS version 6.0.0,...
CVE-2025-28380
A cross-site scripting (XSS) vulnerability exists in OpenC3 COSMOS before v6.0.2 , including version v6.0.0 . The flaw originates from the improper neutralization of input, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the URL parameter . As a res...
CVE-2025-28389
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...
CVE-2025-28381: Cleartext Storage of Sensitive Information in an Environment Variable
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...
CVE-2025-28384: Improper Limitation of a Pathname to a Restricted Directory
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
CVE-2024-43795
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting XSS vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and...
CVE-2024-47529
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting s...
CVE-2024-46977
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...
CVE-2021-25837
Cosmos Network Ethermint = v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cach...
CVE-2021-43839
Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are ...
CVE-2021-25836
Cosmos Network Ethermint = v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memorystateObject.code and is further written to persistent store at the Endblock stage, which may be utilized to build honeypot contrac...
CVE-2021-25835
Cosmos Network Ethermint = v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg conte...
CVE-2021-25834
Cosmos Network Ethermint = v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application...
CVE-2020-27620
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups...