50 matches found
CVE-2026-77602 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...
CVE-2026-77602: Improper Control of Generation of Code
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...
Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager
Somewhere in your estate right now, a certificate is counting down to its expiry date. Today you probably know which one, because renewals still come around annually and someone owns the calendar. The industry is taking that comfort away: the CA/Browser Forum has voted to cut the maximum TLS...
OpenC3 COSMOS - Authenticated OS command injection via the `pypi_url` setting
Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...
PT-2026-36711
Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb QuestDB A SQL injection vulnerability exists in the Time-Series Database...
EUVD-2008-4748
Malware in sbrugna...
EUVD-2020-17376
Malware in sbrugna...
EUVD-2007-4789
Malware in sbrugna...
CVE-2020-24662
SmartStream Transaction Lifecycle Management TLM Reconciliation Premium RP 3.1.0 allows XSS. This was fixed in TLM RP 3.1.0...
tlm-torneriacampostori.it Improper Access Control vulnerability OBB-3844422
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
tlm-torneriacampostori.com Improper Access Control vulnerability OBB-3813863
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2020-24662
SmartStream Transaction Lifecycle Management TLM Reconciliation Premium RP 3.1.0 allows XSS. This was fixed in TLM RP 3.1.0...
Design/Logic Flaw
SmartStream Transaction Lifecycle Management TLM Reconciliation Premium RP 3.1.0 allows XSS. This was fixed in TLM RP 3.1.0...
CVE-2020-24662
SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) prior to version 3.1.0 contains a cross-site scripting (XSS) vulnerability. Multiple sources (NVD entry CVE-2020-24662, Red Hat advisory, CNNVD) confirm that RP
CVE-2020-24662
SmartStream Transaction Lifecycle Management TLM Reconciliation Premium RP 3.1.0 allows XSS. This was fixed in TLM RP 3.1.0...
CVE-2020-24662: Improper Neutralization of Input During Web Page Generation
SmartStream Transaction Lifecycle Management TLM Reconciliation Premium RP 3.1.0 allows XSS. This was fixed in TLM RP 3.1.0...
PT-2021-11054
Name of the Vulnerable Software and Affected Versions: SmartStream Transaction Lifecycle Management TLM Reconciliation Premium RP versions prior to 3.1.0 Description: The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a...
TLM CMS 3.2 - Multiple Remote SQL Injection Vulnerabilities
No description provided by source. TLM CMS v3.2 - Multiple Remote SQL Injection Vulnerabilities Vendor : http://tlm.hebserv.fr/ Download : http://tlm.hebserv.fr/modfile/upload/tlmcms32.zip Ditemukan oleh : k1tk4t - k1tk4t4tnewhack.org Lokasi : Indonesia -- newhackdotorg @ irc.dal.net Kutu pada...