CVE-2023-45281: Improper Neutralization of Input During Web Page Generation

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file...

CVE-2023-45280

Yamcs 5.8.6 allows XSS issue 2 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrar...