Yamcs <=5.8.6 - Cross-Site Scripting

Yamcs 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirecturi parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL. id: CVE-2026-55549 info: name: Yamcs =5.8.6 -...

yamcs__yamcs_CVE-2023-45277_5-8-6

Yamcs Управление полетами Веб-сайт: https://yamcs.org Почтовая рассылка: Google Groups Yamcs — это платформа управления полетами, разработанная на Java. Она использует открытую архитектуру, позволяющую настраивать ее функциональность с помощью YAML-конфигураций. Вы также можете расширить...

CVE-2026-44595

CVE-2026-44595 — Énumération non autorisée d'utilisateurs YAMCS via l'API IAM Résumé Les points de terminaison de l'API IAM listUsers, getUser, listGroups, getGroup dans yamcs-core n'appliquent pas la vérification requise SystemPrivilege.ControlAccess. Tout utilisateur authentifié — même sans auc...

CVE-2026-44596

CVE-2026-44596 — YAMCS : Absence de limitation de débit sur le point d'authentification Résumé Le point d'authentification POST /auth/token dans yamcs-core ne dispose d'aucune forme de limitation de débit, de verrouillage de compte ou de limitation des tentatives échouées. Un attaquant distant no...

CVE-2026-42568

CVE-2026-42568 — Injection LDAP dans LdapAuthModule Résumé Une vulnérabilité d'injection LDAP existe dans org.yamcs.security.LdapAuthModule. Le paramètre username est inséré directement dans les filtres de recherche LDAP sans échappement RFC 4515, permettant un contournement de l'authentification...

CVE-2026-55511

CVE-2026-55511: RCE authentifié via StreamSQL dans Yamcs Preuve de concept non armée et documentation technique pour CVE-2026-55511, une vulnérabilité authentifiée d'injection de code Java dans le compilateur d'expressions d'agrégation StreamSQL de Yamcs. Champ| Valeur ---|--- Produit| Yamcs...

CVE-2026-55566

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55565

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...

CVE-2026-55552

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55559

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55511

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55521

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:19+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p 2026-08-30 09:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mubzpnh6ly27...

CVE-2026-55547

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:17+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq...

CVE-2026-55548

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:15+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf...

CVE-2026-55559

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:13+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9 2026-08-28 22:08:32+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6esqhrrz25 2026-08-30 08:50:05+00:00|...

CVE-2026-55565

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:10+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f 2026-08-28 22:08:40+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6esyapvs2b 2026-08-29 18:10:06+00:00|...