CVE-2024-47529

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-47534.8The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2024-475306.1Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them t CVE-2024-475313.5Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extensio CVE-2024-475326.5RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentiall CVE-2024-475339.8Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulner CVE-2024-475348.2go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if target CVE-2024-475355.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2024-475365.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherw CVE-2024-475379.8GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by str CVE-2024-475389.8GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle CVE-2024-475399.8GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the conv CVE-2024-47545.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business P