nasa

Records87All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high44CVSS 7.0–8.9

Exploited now

nasa records in CISA KEV

No nasa vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cryptolib 27 records HIGH Core Flight System 8 records HIGH Cfitsio 7 records MEDIUM Ait Core 6 records MEDIUM Openmct 6 records MEDIUM Fprime 4 records HIGH Ait Dsn 1 record HIGH Ait Gui 1 record MEDIUM

Records

6 records in Openmct · all components

TI-2023-24635 CVE-2023-45884 · GHSA-4g88-4hgm-m99x

Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through…

MEDIUM 62

Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00328 Published 2023-11-09 Fixed in 3.1.1 CWE-352

TI-2023-24636 CVE-2023-45885 · GHSA-v8fc-qxvj-f3mg

Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00461 Published 2023-11-09 No fix listed CWE-79

TI-2023-24272 CVE-2023-45282 · GHSA-4xcx-cwrq-w792

In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.

MEDIUM 41

In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0116 Published 2023-10-06 No fix listed CWE-1321

TI-2022-07228 CVE-2022-23054 · GHSA-wjmx-7pv5-fjrg

Openmct XSS via the “Summary Widget”

LOW 28

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00615 Published 2022-02-20 No fix listed CWE-79

TI-2022-07227 CVE-2022-23053 · GHSA-xw8c-2r63-9grf

Openmct XSS via the “Condition Widget”

LOW 28

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00615 Published 2022-02-20 No fix listed CWE-79

TI-2022-06470 CVE-2022-22126 · GHSA-7v96-4336-925w

Openmct XSS via the “Web Page” element

LOW 28

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00615 Published 2022-02-20 No fix listed CWE-79

Open these records in search →