Ryan Melton

3 exploits Active since Oct 2024
CVE-2024-43795 WRITEUP MEDIUM WRITEUP
Openc3 Cosmos < 5.19.0 - XSS
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition.
CVSS 6.1
CVE-2024-46977 WRITEUP MEDIUM WRITEUP
Openc3 Cosmos < 5.19.0 - Path Traversal
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.
CVSS 6.5
CVE-2024-47529 WRITEUP MEDIUM WRITEUP
OpenC3 COSMOS <5.19.0 - XSS
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.
CVSS 6.5