openc3 vulnerabilities (RubyGems)
11 vulnerabilities.
-
openc3RubyGems OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) 9.9 Critical -
openc3RubyGems OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting 8.8 High -
openc3RubyGems OpenC3 COSMOS: Administrative Actions via the Script Runner Tool 9.6 Critical -
openc3RubyGems OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base 9.6 Critical -
openc3RubyGems OpenC3 COSMOS: Self-XSS in the Command Sender 4.6 Medium -
openc3RubyGems OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames 4.3 Medium -
openc3RubyGems OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence 8.1 High -
openc3RubyGems Unauthenticated Remote Code Execution in openc3-api 10.0 Critical -
openc3RubyGems OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`) 4.8 Medium -
openc3RubyGems OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`) 5.3 Medium -
openc3RubyGems OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`) 5.1 Medium