CVE-2023-45277

CVE-2023-45277 affects Yamcs 5.8.6. The issue is a directory traversal in the storage API function, allowing an attacker to escape the base directory of buckets, freely navigate system directories, and read arbitrary files. The vulnerability is network-accessible with low attack complexity and no...

CVE-2023-45278

CVE-2023-45278 affects Yamcs before and including 5.8.6 in its storage API: a directory traversal vulnerability that allows an attacker to delete arbitrary files via a crafted HTTP DELETE request. Root cause: improper handling of file paths in the storage component leading to unintended file dele...

CVE-2023-45279

Yamcs 5.8.6 is exposed to a Cross-site Scripting (XSS) issue through its Bucket storage mechanism. Buckets accept file uploads, and an attacker can reference a malicious JavaScript file in a display stored in the bucket. A user who opens that uploaded display (via Telemetry) could execute the inj...

CVE-2023-45280

CVE-2023-45280 affects Yamcs 5.8.6. The vulnerability is a Cross-site Scripting (XSS) flaw via the Bucket storage mechanism: an HTML file containing arbitrary JavaScript can be uploaded and, when the user opens it, the browser executes the script. The issue is attributed to insufficient validatio...

CVE-2023-45281

CVE-2023-45281 affects Yamcs 5.8.6. An attacker can obtain the session cookie by uploading a crafted HTML file, exposing confidentiality (session data) with no availability impact. CVSS 3.1 base score 6.1 (Network, Low attack complexity, No privileges required, User interaction required, Confiden...

CVE-2026-44596

Summary (CVE-2026-44596) Yamcs’ authentication endpoint POST /auth/token (in yamcs-core) lacked rate limiting, account lockout, and throttling for failed attempts prior to v5.12.7. An unauthenticated remote attacker could perform unlimited password-guessing against any user account, enabling brut...

CVE-2026-44595

CVE-2026-44595 affects Yamcs’ core IAM API endpoints: GET /api/iam/users, GET /api/iam/users/{name}, GET /api/iam/groups, and GET /api/iam/groups/{name}. The root cause is missing enforcement of SystemPrivilege.ControlAccess in Yamcs’ IAM API (IamApi.java), enabling any authenticated user—even wi...

CVE-2026-46621

Summary of CVE-2026-46621 (Yamcs) : The issue arises in Yamcs’ script evaluation engine for Python algorithms, where user-controlled code is dynamically compiled and executed via Jython (JSR-223) without a secure sandbox. An authenticated user with the ChangeMissionDatabase privilege can override...

CVE-2026-46562

Summary : CVE-2026-46562 affects Yamcs releases from 4.7.3 through 5.12.6. The vulnerability stems from constructing the Nashorn ScriptEngine without a ClassFilter, allowing a user with ChangeMissionDatabase privilege (or unauthenticated in default config) to execute arbitrary Java via Java.type,...

CVE-2026-44632

CVE-2026-44632 affects Yamcs: the server-side evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory) can compile and execute user-supplied algorithm text via Janino without sandboxing. An authenticated user with ChangeMissionDatabase privilege could override an algorithm throug...

CVE-2026-55548

In Yamcs, CVE-2026-55548 affects the PacketsApi.exportPackets endpoint. The root cause was failure to enforce per-packet ReadPacket privileges when a request supplied an empty packet-name list, causing no WHERE pname IN filter and the onTuple handler to stream packets without per-row authorizatio...