org.yamcs:yamcs-core vulnerabilities (Maven)
16 vulnerabilities.
org.yamcs:yamcs-coreMavenYamcs: DOM XSS in Extension Routing4.3 Mediumorg.yamcs:yamcs-coreMavenYamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)9.9 Criticalorg.yamcs:yamcs-coreMavenYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)9.8 Criticalorg.yamcs:yamcs-coreMavenYamcs: Unauthenticated Directory Traversal7.5 Highorg.yamcs:yamcs-coreMavenYamcs: Reflected XSS in the URL of the Authorize Endpoint6.5 Mediumorg.yamcs:yamcs-coreMavenYamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration4.3 Mediumorg.yamcs:yamcs-coreMavenYamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce6.5 Mediumorg.yamcs:yamcs-coreMavenYamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API8.8 Highorg.yamcs:yamcs-coreMavenYamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`9.1 Criticalorg.yamcs:yamcs-coreMavenYamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets4.3 Mediumorg.yamcs:yamcs-coreMavenYamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection9.1 Criticalorg.yamcs:yamcs-coreMavenYamcs: Remote Code Execution via Mission Database algorithm override9.8 Criticalorg.yamcs:yamcs-coreMavenYamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`9.1 Criticalorg.yamcs:yamcs-coreMavenYamcs: No Rate Limiting on Authentication Endpoint6.5 Mediumorg.yamcs:yamcs-coreMavenYamcs: Unauthorized user enumeration via IAM API endpoints4.3 Mediumorg.yamcs:yamcs-coreMavenYamcs Vulnerable to LDAP Injection in LdapAuthModule4.3 Medium