OpenC3 COSMOS 安全漏洞

OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0, which originates from storing user passwords in an unencrypted form in the Web browser's LocalStorage...

CVE-2024-43795: Improper Neutralization of Input During Web Page Generation

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting XSS vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and...

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

Summary OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting see GHSL-2024-128. Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition Impa...

PT-2024-32312 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS versions prior to 5.19.0 Description: A path traversal vulnerability inside of LocalMode's open local file method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllershow on the w...

CVE-2024-46977: Improper Limitation of a Pathname to a Restricted Directory

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

PT-2024-32642 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS versions prior to 5.19.0 Description: OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting. The issue may...

OpenC3 COSMOS 路径遍历漏洞

OpenC3 COSMOS is an OpenC3 open source application. A path traversal vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0. An attacker exploits this vulnerability to download any .txt file by running ScreensControllershow on the web server...

OpenC3 COSMOS 跨站脚本漏洞

OpenC3 COSMOS is an OpenC3 open source application. A cross-site scripting vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0. An attacker exploits this vulnerability to perform cross-site scripting attacks...

GO-2024-3121 Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security

Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security...

Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data

Cybersecurity researchers have disclosed a critical security flaw impacting Microsoft's Copilot Studio that could be exploited to access sensitive information. Tracked as CVE-2024-38206 CVSS score: 8.5, the vulnerability has been described as an information disclosure bug stemming from a...

GO-2022-0813 Authentication bypass by capture-replay in github.com/cosmos/ethermint

Authentication bypass by capture-replay in github.com/cosmos/ethermint...

GO-2023-2156 Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware

Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware...

GO-2024-3068 Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia

Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia...

Missing Cryptographic Equivocation

github.com/cosmos/gaia is vulnerable to Missing Cryptographic Equivocation. The vulnerability is caused due to an issue in the Interchain Security ICS module that could result in the slashing of a validator for an "old" equivocation...

Cosmos Hub (Gaia): The check for the height of cryptographic equivocation evidence is missing

Summary An issue was identified in the Interchain Security ICS module that could result in the slashing of a validator for an "old" equivocation. The height-base filter for consumer equivocation evidence introduced in v2.4.0-lsm was re-enabled. Details ICS v2.4.0-lsm introduced a height-base filt...

CVE-2024-39696

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account EOA or contract as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization...

CVE-2024-39696 Evmos vulnerable to exploit of smart contract account and vesting

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account EOA or contract as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization...

CVE-2024-39696 Evmos vulnerable to exploit of smart contract account and vesting

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account EOA or contract as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization...

CVE-2024-39696: Incorrect Authorization

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account EOA or contract as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization...

Insufficient Control Flow Management

Evmos is vulnerable to Insufficient Control Flow Management. The vulnerability is due to different ante handler checks for Cosmos and Ethereum transactions, allowing a clawback account to bypass Cosmos checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos...