Skip to content
Threat Feed
Subscribe

Tag

Cosmos

3 briefs RSS
critical advisory

OpenC3 COSMOS Authenticated Remote Code Execution

Authenticated users can achieve arbitrary code execution in OpenC3 COSMOS by writing malicious payloads into user-writable configuration overlays that are subsequently rendered as code by the application.

COSMOS +2 rce authenticated-rce openc3 xss web-vulnerability session-hijacking
5t 1c updated
critical advisory

OpenC3 COSMOS SQL Injection Vulnerability in QuestDB Time-Series Database

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS, allowing an authenticated remote user to execute arbitrary SQL commands, including telemetry data disclosure and deletion.

OpenC3 sql-injection cosmos questdb telemetry
2r 3t
critical advisory

OpenC3 COSMOS Script Runner Permissions Bypass

The OpenC3 COSMOS Script Runner widget allows authenticated users to bypass API permissions checks and execute administrative actions by running specially crafted Python and Ruby scripts, leading to data manipulation and privilege escalation.

openc3 cosmos script-runner permissions-bypass privilege-escalation
2r 1t