yamcs__yamcs_CVE-2023-45277_5-8-6

Yamcs Mission Control Sitio web: https://yamcs.org Lista de correo: Google Groups Yamcs es un marco de trabajo para control de misiones desarrollado en Java. Utiliza una arquitectura abierta que permite adaptar su conjunto de funcionalidades mediante archivos de configuración yaml. También puedes...

CVE-2026-44595

CVE-2026-44595 — Enumeración No Autorizada de Usuarios en YAMCS a través de la API de IAM Resumen Los endpoints de la API de IAM listUsers, getUser, listGroups, getGroup en yamcs-core no aplican la verificación requerida de SystemPrivilege.ControlAccess. Cualquier usuario autenticado — incluso un...

CVE-2026-44596

CVE-2026-44596 — YAMCS Sin Límite de Tasa en el Endpoint de Autenticación Resumen El endpoint de autenticación POST /auth/token en yamcs-core carece de cualquier forma de limitación de tasa, bloqueo de cuenta o estrangulamiento de intentos fallidos. Un atacante remoto no autenticado puede realiza...

CVE-2026-42568

CVE-2026-42568 — Inyección LDAP en LdapAuthModule de YAMCS Resumen Existe una vulnerabilidad de inyección LDAP en org.yamcs.security.LdapAuthModule. El parámetro de nombre de usuario se inserta directamente en los filtros de búsqueda LDAP sin escape según RFC 4515, lo que permite omitir la...

CVE-2026-55511

CVE-2026-55511: RCE autenticado en Yamcs StreamSQL Prueba de concepto no armada y documentación técnica para CVE-2026-55511, una vulnerabilidad autenticada de inyección de código Java en el compilador de expresiones agregadas StreamSQL de Yamcs...

CVE-2026-55566

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55565

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

CVE-2026-55552

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55559

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55511

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55521

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:19+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p 2026-08-30 09:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mubzpnh6ly27...

CVE-2026-55547

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:17+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq...

CVE-2026-55559

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:13+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9 2026-08-28 22:08:32+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6esqhrrz25 2026-08-30 08:50:05+00:00|...

CVE-2026-55565

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:10+00:00| published-proof-of-concept| https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f 2026-08-28 22:08:40+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6esyapvs2b 2026-08-29 18:10:06+00:00|...

Yamcs has DOM XSS in Extension Routing

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134. Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted co...

GHSA-9272-WG2R-7XMX Yamcs has DOM XSS in Extension Routing

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134. Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted co...