org.yamcs:yamcs-core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 16 advisory(ies)
Advisories (16)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2g95-6x5q-xjwj Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection | < 5.12.7 | Affected |
| GHSA-3g44-3m7x-cgg2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-524g-x36v-9wm6 Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` | < 5.12.7 | Affected |
| GHSA-73mf-m39p-wpm9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-8xjq-pr36-ccgf Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-9272-wg2r-7xmx Yamcs has DOM XSS in Extension Routing | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-962x-ccwf-8x6p Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-9jg3-g3wh-w9pj Yamcs has Unauthenticated Directory Traversal | < 5.12.0 | Affected |
| GHSA-c64q-hj4j-375f Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-cqh3-jg8p-336j Yamcs Vulnerable to LDAP Injection in LdapAuthModule | < 5.12.7 | Affected |
| GHSA-cvw4-55pp-3hfq Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration | 5.13.0 – < 5.13.2 ; < 5.12.8 | Affected |
| GHSA-fwww-cp23-7f5g Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce | < 5.12.8 ; 5.13.0 – < 5.13.2 | Affected |
| GHSA-p2rj-mrmc-9w29 Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints | < 5.12.7 | Affected |
| GHSA-rxpg-wjf8-qv9c Yamcs has Reflected XSS in the URL of the Authorize Endpoint | < 5.9.4 | Affected |
| GHSA-vmwp-vh32-rj75 Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override | < 5.12.7 | Affected |
| GHSA-w5r6-mcgq-7pq4 Yamcs has No Rate Limiting on Authentication Endpoint | < 5.12.7 | Affected |
Sources
| Source | Licence |
|---|