yamcs__yamcs_CVE-2023-45277_5-8-6

Yamcs 任务控制中心 网站：https://yamcs.org 邮件列表：Google Groups Yamcs 是一个用 Java 开发的任务控制框架。它采用开放式架构，允许通过 yaml 配置文件定制功能集。您也可以通过编写自定义 Java 类来扩展默认功能集。 要开始开发您自己的 Yamcs 应用程序，请按照我们的入门指南进行操作。 文档 服务器手册：https://docs.yamcs.org/yamcs-server-manual/ Javadoc：https://docs.yamcs.org/javadoc/yamcs/latest/ 许可证 Yamcs 遵循 Affer...

CVE-2026-44595

CVE-2026-44595 — YAMCS IAM APIを介した未認可ユーザー列挙 概要 yamcs-coreのIAM APIエンドポイント（listUsers、getUser、listGroups、getGroup）は、必要なSystemPrivilege.ControlAccessチェックを実施していません。認証されたユーザーは誰でも（権限がなくても）すべてのユーザーアカウント、スーパーユーザーステータス、グループメンバーシップを列挙できます。 フィールド| 値 ---|--- CVE| CVE-2026-44595 深刻度| MEDIUM CVSS 4.3 CWE|...

CVE-2026-44596

CVE-2026-44596 — YAMCS 认证端点缺少速率限制 概述 yamcs-core 中的认证端点 POST /auth/token 缺乏任何形式的速率限制、帐户锁定或失败尝试节流。未认证的远程攻击者可以对任何用户帐户执行无限制的密码猜测尝试。 字段| 值 ---|--- CVE| CVE-2026-44596 严重程度| MEDIUM CVSS 5.3 CWE| CWE-307: 对过多认证尝试的限制不当 受影响版本| yamcs-core = 5.12.7。 时间线 日期| 事件 ---|--- 2026-05| 漏洞报告 2026-05-27| 在 yamcs-core...

CVE-2026-42568

CVE-2026-42568 — YAMCS LdapAuthModule におけるLDAPインジェクション 概要 org.yamcs.security.LdapAuthModule にLDAPインジェクションの脆弱性が存在します。ユーザー名パラメータがRFC 4515エスケープなしでLDAP検索フィルターに直接挿入されるため、認証回避が可能です。...

CVE-2026-55511

CVE-2026-55511: Yamcs StreamSQL 認証済みRCE CVE-2026-55511 に対する非武器化された概念実証および技術文書です。これは、Yamcs StreamSQL 集約式コンパイラにおける認証済み Java コードインジェクションの脆弱性です。...

CVE-2026-55566

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55565

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...

CVE-2026-55552

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55559

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55511

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55521

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:19+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p 2026-08-30 09:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mubzpnh6ly27...

CVE-2026-55547

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:17+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq...

CVE-2026-55559

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:13+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9 2026-08-28 22:08:32+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6esqhrrz25 2026-08-30 08:50:05+00:00|...

CVE-2026-55565

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:10+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f 2026-08-28 22:08:40+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6esyapvs2b 2026-08-29 18:10:06+00:00|...

GHSA-9272-WG2R-7XMX Yamcs has DOM XSS in Extension Routing

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134. Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted co...

Yamcs has DOM XSS in Extension Routing

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134. Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted co...