CVE-2025-28381

CVE-2025-28381 affects OpenC3 COSMOS prior to v6.0.2, where service credentials are exposed as environment variables stored in all containers. The vulnerability is due to credential leakage in containerized environment variables, enabling attackers to access credentials if they can reach the runt...

CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

PT-2025-25411 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Recommendations: For OpenC3 COSMOS version...

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

CVE-2025-28388

CVE-2025-28388 affects OpenC3 COSMOS prior to v6.0.2, where hardcoded credentials for the Service Account are disclosed. The vulnerability enables potential unauthorized access with high impact as indicated by the CVSS metrics (CRITICAL, 9.8; network attack; no privileges required; user interacti...

CVE-2025-28384

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

PT-2025-25412 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: A credential leak in OpenC3 COSMOS allows attackers to access service credentials as environment variables stored in all containers. This issue is related to the cleartext storage of sensitive...

PT-2025-25415 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS allows attackers to execute arbitrary code via uploading a crafted .txt file. Recommendations: For OpenC3...

PT-2025-25416 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue is related to hardcoded credentials for the Service Account. Recommendations: For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique,...

CVE-2025-28389

OpenC3 COSMOS v6.0.0 is affected by a weakness in password policy that allows brute-force authentication bypass. The CVE describes weak password requirements as the root cause. Impact is described as high for confidentiality, integrity, and availability, with network attack vector and no user int...

PT-2025-25417 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue is related to weak password requirements, allowing attackers to bypass authentication using a brute force attack. Recommendations: For OpenC3 COSMOS version 6.0.0, consider implementing...

CVE-2025-28384

CVE-2025-28384 affects OpenC3 COSMOS prior to 6.1.0. The vulnerability is a directory traversal in the /script-api/scripts/ endpoint, enabling an attacker to access arbitrary files via crafted requests. Root cause is an insecure handling of path input in that endpoint. Impact per sources indicate...

CVE-2025-28382

OpenC3 COSMOS has a directory traversal vulnerability in the openc3-api/tables endpoint affecting versions prior to 6.1.0. Impact is high (CVE-2025-28382) with potential unauthorized access; CVSS 3.1 base score 7.5. A fixed release is 6.1.0. Remediation is to upgrade to 6.1.0 or apply vendor-prov...

PT-2025-25414 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue allows attackers to execute a directory traversal in the "/script-api/scripts/" endpoint. Recommendations: For OpenC3 COSMOS version 6.0.0, consider restricting access to the...

CVE-2025-28380

Summary of CVE-2025-28380 : OpenC3 COSMOS is affected by an XSS vulnerability that enables execution of arbitrary web scripts/HTML via a crafted payload in a URL parameter, observed in versions prior to 6.0.2. The reports consistently identify the vulnerable component as the web-facing URL parame...

CVE-2025-28386

CVE-2025-28386 affects OpenC3 COSMOS v6.0.0 in the Plugin Management component. The vulnerability allows remote code execution when a crafted .txt file is uploaded, enabling arbitrary code execution with network access and no user interaction. CVSS v3.1 base score 9.8 (CRITICAL). Remediation guid...