Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-44632 (GCVE-0-2026-44632)

Vulnerability from nvd – Published: 2026-07-16 16:05 – Updated: 2026-07-16 16:46

Title

Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

Summary

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/3c550348f86…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/4ff8fda642e…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44632",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T16:45:59.615647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T16:46:26.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm\u0027s text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:05:28.554Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-524g-x36v-9wm6",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44632",
    "datePublished": "2026-07-16T16:05:28.554Z",
    "dateReserved": "2026-05-07T15:30:10.874Z",
    "dateUpdated": "2026-07-16T16:46:26.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44596 (GCVE-0-2026-44596)

Vulnerability from nvd – Published: 2026-07-16 16:04 – Updated: 2026-07-17 14:05

Title

Yamcs: No Rate Limiting on Authentication Endpoint

Summary

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/309218c6516…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/64392df531f…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44596",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T14:05:04.998522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T14:05:15.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:04:11.794Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w5r6-mcgq-7pq4",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: No Rate Limiting on Authentication Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44596",
    "datePublished": "2026-07-16T16:04:11.794Z",
    "dateReserved": "2026-05-06T21:49:12.426Z",
    "dateUpdated": "2026-07-17T14:05:15.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44595 (GCVE-0-2026-44595)

Vulnerability from nvd – Published: 2026-07-16 16:02 – Updated: 2026-07-16 16:02

Title

Yamcs: Unauthorized user enumeration via IAM API endpoints

Summary

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/0e12b518f10…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/e90099fba98…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:02:46.293Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p2rj-mrmc-9w29",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: Unauthorized user enumeration via IAM API endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44595",
    "datePublished": "2026-07-16T16:02:46.293Z",
    "dateReserved": "2026-05-06T21:49:12.426Z",
    "dateUpdated": "2026-07-16T16:02:46.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-47311 (GCVE-0-2023-47311)

Vulnerability from nvd – Published: 2023-11-20 00:00 – Updated: 2024-08-02 21:09

Summary

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/more-xss-clickjack…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:09:36.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T20:40:29.685Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-47311",
    "datePublished": "2023-11-20T00:00:00.000Z",
    "dateReserved": "2023-11-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T21:09:36.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46471 (GCVE-0-2023-46471)

Vulnerability from nvd – Published: 2023-11-20 00:00 – Updated: 2025-06-10 13:47

Summary

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/more-xss-clickjack…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:41.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-46471",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T13:46:14.604182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-10T13:47:30.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T20:22:28.096Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-46471",
    "datePublished": "2023-11-20T00:00:00.000Z",
    "dateReserved": "2023-10-23T00:00:00.000Z",
    "dateUpdated": "2025-06-10T13:47:30.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46470 (GCVE-0-2023-46470)

Vulnerability from nvd – Published: 2023-11-20 00:00 – Updated: 2024-08-02 20:45

Summary

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/more-xss-clickjack…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:41.932Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T20:17:22.357Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-46470",
    "datePublished": "2023-11-20T00:00:00.000Z",
    "dateReserved": "2023-10-23T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:45:41.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45280 (GCVE-0-2023-45280)

Vulnerability from nvd – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.249Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There\u0027s a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T21:50:38.661Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45280",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45279 (GCVE-0-2023-45279)

Vulnerability from nvd – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There\u0027s a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T21:47:14.646Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45279",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45281 (GCVE-0-2023-45281)

Vulnerability from nvd – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T16:49:54.642Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45281",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45278 (GCVE-0-2023-45278)

Vulnerability from nvd – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.202Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T16:33:08.513Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45278",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45277 (GCVE-0-2023-45277)

Vulnerability from nvd – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:14

Summary

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:14:19.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T16:28:18.356Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45277",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:14:19.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-44632 (GCVE-0-2026-44632)

Vulnerability from cvelistv5 – Published: 2026-07-16 16:05 – Updated: 2026-07-16 16:46

Title

Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

Summary

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/3c550348f86…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/4ff8fda642e…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44632",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T16:45:59.615647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T16:46:26.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm\u0027s text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:05:28.554Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-524g-x36v-9wm6",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44632",
    "datePublished": "2026-07-16T16:05:28.554Z",
    "dateReserved": "2026-05-07T15:30:10.874Z",
    "dateUpdated": "2026-07-16T16:46:26.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44596 (GCVE-0-2026-44596)

Vulnerability from cvelistv5 – Published: 2026-07-16 16:04 – Updated: 2026-07-17 14:05

Title

Yamcs: No Rate Limiting on Authentication Endpoint

Summary

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/309218c6516…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/64392df531f…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44596",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T14:05:04.998522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T14:05:15.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:04:11.794Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w5r6-mcgq-7pq4",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: No Rate Limiting on Authentication Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44596",
    "datePublished": "2026-07-16T16:04:11.794Z",
    "dateReserved": "2026-05-06T21:49:12.426Z",
    "dateUpdated": "2026-07-17T14:05:15.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44595 (GCVE-0-2026-44595)

Vulnerability from cvelistv5 – Published: 2026-07-16 16:02 – Updated: 2026-07-16 16:02

Title

Yamcs: Unauthorized user enumeration via IAM API endpoints

Summary

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/yamcs/yamcs/security/advisorie…	x_refsource_CONFIRM
https://github.com/yamcs/yamcs/commit/0e12b518f10…	x_refsource_MISC
https://github.com/yamcs/yamcs/commit/e90099fba98…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yamcs	yamcs	Affected: < 5.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "yamcs",
          "vendor": "yamcs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T16:02:46.293Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88"
        },
        {
          "name": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
        },
        {
          "name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p2rj-mrmc-9w29",
        "discovery": "UNKNOWN"
      },
      "title": "Yamcs: Unauthorized user enumeration via IAM API endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44595",
    "datePublished": "2026-07-16T16:02:46.293Z",
    "dateReserved": "2026-05-06T21:49:12.426Z",
    "dateUpdated": "2026-07-16T16:02:46.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-47311 (GCVE-0-2023-47311)

Vulnerability from cvelistv5 – Published: 2023-11-20 00:00 – Updated: 2024-08-02 21:09

Summary

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/more-xss-clickjack…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:09:36.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T20:40:29.685Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-47311",
    "datePublished": "2023-11-20T00:00:00.000Z",
    "dateReserved": "2023-11-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T21:09:36.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46471 (GCVE-0-2023-46471)

Vulnerability from cvelistv5 – Published: 2023-11-20 00:00 – Updated: 2025-06-10 13:47

Summary

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/more-xss-clickjack…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:41.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-46471",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T13:46:14.604182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-10T13:47:30.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T20:22:28.096Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-46471",
    "datePublished": "2023-11-20T00:00:00.000Z",
    "dateReserved": "2023-10-23T00:00:00.000Z",
    "dateUpdated": "2025-06-10T13:47:30.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46470 (GCVE-0-2023-46470)

Vulnerability from cvelistv5 – Published: 2023-11-20 00:00 – Updated: 2024-08-02 20:45

Summary

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/more-xss-clickjack…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:41.932Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-20T20:17:22.357Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/more-xss-clickjacking-yamcs-v586-visionspace-technologies-uvevf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-46470",
    "datePublished": "2023-11-20T00:00:00.000Z",
    "dateReserved": "2023-10-23T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:45:41.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45280 (GCVE-0-2023-45280)

Vulnerability from cvelistv5 – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.249Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There\u0027s a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T21:50:38.661Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45280",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45278 (GCVE-0-2023-45278)

Vulnerability from cvelistv5 – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.202Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T16:33:08.513Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45278",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45277 (GCVE-0-2023-45277)

Vulnerability from cvelistv5 – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:14

Summary

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:14:19.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T16:28:18.356Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45277",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:14:19.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45279 (GCVE-0-2023-45279)

Vulnerability from cvelistv5 – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

2 references

URL	Tags
https://github.com/yamcs/yamcs/compare/yamcs-5.8.…
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There\u0027s a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T21:47:14.646Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7"
        },
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45279",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45281 (GCVE-0-2023-45281)

Vulnerability from cvelistv5 – Published: 2023-10-19 00:00 – Updated: 2024-08-02 20:21

Summary

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

1 reference

URL	Tags
https://www.linkedin.com/pulse/yamcs-vulnerabilit…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-19T16:49:54.642Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-45281",
    "datePublished": "2023-10-19T00:00:00.000Z",
    "dateReserved": "2023-10-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T20:21:15.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by spaceapplications

CVE-2026-44632 (GCVE-0-2026-44632)

CVE-2026-44596 (GCVE-0-2026-44596)

CVE-2026-44595 (GCVE-0-2026-44595)

CVE-2023-47311 (GCVE-0-2023-47311)

CVE-2023-46471 (GCVE-0-2023-46471)

CVE-2023-46470 (GCVE-0-2023-46470)

CVE-2023-45280 (GCVE-0-2023-45280)

CVE-2023-45279 (GCVE-0-2023-45279)

CVE-2023-45281 (GCVE-0-2023-45281)

CVE-2023-45278 (GCVE-0-2023-45278)

CVE-2023-45277 (GCVE-0-2023-45277)

CVE-2026-44632 (GCVE-0-2026-44632)

CVE-2026-44596 (GCVE-0-2026-44596)

CVE-2026-44595 (GCVE-0-2026-44595)

CVE-2023-47311 (GCVE-0-2023-47311)

CVE-2023-46471 (GCVE-0-2023-46471)

CVE-2023-46470 (GCVE-0-2023-46470)

CVE-2023-45280 (GCVE-0-2023-45280)

CVE-2023-45278 (GCVE-0-2023-45278)

CVE-2023-45277 (GCVE-0-2023-45277)

CVE-2023-45279 (GCVE-0-2023-45279)

CVE-2023-45281 (GCVE-0-2023-45281)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by spaceapplications

CVE-2026-44632 (GCVE-0-2026-44632)

CVE-2026-44596 (GCVE-0-2026-44596)

CVE-2026-44595 (GCVE-0-2026-44595)

CVE-2023-47311 (GCVE-0-2023-47311)

CVE-2023-46471 (GCVE-0-2023-46471)

CVE-2023-46470 (GCVE-0-2023-46470)

CVE-2023-45280 (GCVE-0-2023-45280)

CVE-2023-45279 (GCVE-0-2023-45279)

CVE-2023-45281 (GCVE-0-2023-45281)

CVE-2023-45278 (GCVE-0-2023-45278)

CVE-2023-45277 (GCVE-0-2023-45277)

CVE-2026-44632 (GCVE-0-2026-44632)

CVE-2026-44596 (GCVE-0-2026-44596)

CVE-2026-44595 (GCVE-0-2026-44595)

CVE-2023-47311 (GCVE-0-2023-47311)

CVE-2023-46471 (GCVE-0-2023-46471)

CVE-2023-46470 (GCVE-0-2023-46470)

CVE-2023-45280 (GCVE-0-2023-45280)

CVE-2023-45278 (GCVE-0-2023-45278)

CVE-2023-45277 (GCVE-0-2023-45277)

CVE-2023-45279 (GCVE-0-2023-45279)

CVE-2023-45281 (GCVE-0-2023-45281)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.