852 matches found
CVE-2025-28382
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
CVE-2025-28381
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...
CVE-2025-28384
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
CVE-2025-28381
The OpenC3 COSMOS framework, specifically versions prior to v6.0.2 (including version 6.0.0), contains a credential leak vulnerability. The root cause is the cleartext storage of sensitive information in environment variables, which are subsequently stored across all containers. This allows an at...
PT-2025-25414
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue allows attackers to execute a directory traversal in the "/script-api/scripts/" endpoint. Recommendations For OpenC3 COSMOS version 6.0.0, consider restricting access to the...
CVE-2025-28386: Improper Control of Generation of Code
A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file...
CVE-2025-28388: Use of Hard-coded Credentials
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...
CVE-2025-28386
The OpenC3 COSMOS v6.0.0 application is vulnerable to Remote Code Execution (RCE) via its Plugin Management component. The root cause is an Arbitrary Code Injection flaw in the plugin_model.rb script, where an attacker can upload a crafted requirements.txt file containing a malicious plugin to ex...
CVE-2025-28389
The OpenC3 COSMOS v6.0.0 application is vulnerable to authentication bypass due to weak password requirements . The software supports clear-text passwords, which enables an attacker to gain unauthorized access via a brute force attack . As a mitigation, users are advised to use authentication tok...
CVE-2025-28384
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
CVE-2025-28380
A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal...
OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal...
OpenC3 COSMOS 安全漏洞
OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to 6.1.0 that stems from the /script-api/scripts/ endpoint being vulnerable to directory traversal attacks...
OpenC3 COSMOS 安全漏洞
OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS version v6.0.0, which stems from the fact that uploading a specially crafted .txt file may result in the execution of arbitrary code...
PT-2025-25415 · Openc3 · Openc3 Cosmos
Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS allows attackers to execute arbitrary code via uploading a crafted .txt file. Recommendations: For OpenC3...
CVE-2025-28381
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...
CVE-2025-28384
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
PT-2025-25413
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue allows attackers to execute a directory traversal in the "openc3-api/tables" endpoint. Recommendations For OpenC3 COSMOS version 6.0.0, consider restricting access to the "openc3-api/tables"...