302 matches found
CVE-2026-44595
CVE-2026-44595 — Enumeración No Autorizada de Usuarios en YAMCS a través de la API de IAM Resumen Los endpoints de la API de IAM listUsers, getUser, listGroups, getGroup en yamcs-core no aplican la verificación requerida de SystemPrivilege.ControlAccess. Cualquier usuario autenticado — incluso un...
CVE-2026-44596
CVE-2026-44596 — YAMCS Sin Límite de Tasa en el Endpoint de Autenticación Resumen El endpoint de autenticación POST /auth/token en yamcs-core carece de cualquier forma de limitación de tasa, bloqueo de cuenta o estrangulamiento de intentos fallidos. Un atacante remoto no autenticado puede realiza...
Yamcs <=5.8.6 - Cross-Site Scripting
Yamcs 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirecturi parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL. id: CVE-2026-55549 info: name: Yamcs =5.8.6 -...
Yamcs <=5.11.12 - Arbitrary File Read
Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handle...
CVE-2026-42568
CVE-2026-42568 — Inyección LDAP en LdapAuthModule de YAMCS Resumen Existe una vulnerabilidad de inyección LDAP en org.yamcs.security.LdapAuthModule. El parámetro de nombre de usuario se inserta directamente en los filtros de búsqueda LDAP sin escape según RFC 4515, lo que permite omitir la...
yamcs__yamcs_CVE-2023-45277_5-8-6
Yamcs Mission Control Sitio web: https://yamcs.org Lista de correo: Google Groups Yamcs es un marco de trabajo para control de misiones desarrollado en Java. Utiliza una arquitectura abierta que permite adaptar su conjunto de funcionalidades mediante archivos de configuración yaml. También puedes...
CVE-2026-55511
CVE-2026-55511: RCE autenticado en Yamcs StreamSQL Prueba de concepto no armada y documentación técnica para CVE-2026-55511, una vulnerabilidad autenticada de inyección de código Java en el compilador de expresiones agregadas StreamSQL de Yamcs. Campo| Valor ---|--- Producto| Yamcs...
Exploit for CVE-2026-55559
Yamcs reconfigureInstance YAML Injection RCE Unauthentica...
yamcs-reconfigure-template-injection-poc
Yamcs reconfigureInstance YAML Injection RCE Unauthentica...
CVE-2026-55565
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...
CVE-2026-55566
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...
CVE-2026-55552
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...
CVE-2026-55521
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...
CVE-2026-55545
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...
CVE-2026-55549
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...
CVE-2026-55547
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...
CVE-2026-55559
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...
CVE-2026-55511
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...
CVE-2026-55521
creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:19+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p 2026-08-30 09:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mubzpnh6ly27...