org.yamcs:yamcs-core (Maven)
Advisories
24
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.13.2 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.yamcs</groupId><artifactId>yamcs-core</artifactId><version>5.13.2</version></dependency>gradle
implementation("org.yamcs:yamcs-core:5.13.2")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9272-wg2r-7xmx Yamcs has DOM XSS in Extension Routing |
Medium EPSS 0.38% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-9272-wg2r-7xmx Yamcs has DOM XSS in Extension Routing |
Medium EPSS 0.38% |
< 5.12.8 | 5.12.8 |
| GHSA-c64q-hj4j-375f Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) |
Critical EPSS 0.65% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-c64q-hj4j-375f Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) |
Critical EPSS 0.65% |
< 5.12.8 | 5.12.8 |
| GHSA-73mf-m39p-wpm9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) |
Critical EPSS 0.78% |
< 5.12.8 | 5.12.8 |
| GHSA-73mf-m39p-wpm9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) |
Critical EPSS 0.78% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-9jg3-g3wh-w9pj Yamcs has Unauthenticated Directory Traversal |
High EPSS 1.72% |
< 5.12.0 | 5.12.0 |
| GHSA-rxpg-wjf8-qv9c Yamcs has Reflected XSS in the URL of the Authorize Endpoint |
Medium EPSS 1.31% |
< 5.9.4 | 5.9.4 |
| GHSA-cvw4-55pp-3hfq Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration |
Medium EPSS 0.34% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-cvw4-55pp-3hfq Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration |
Medium EPSS 0.34% |
< 5.12.8 | 5.12.8 |
| GHSA-fwww-cp23-7f5g Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce |
Medium EPSS 0.45% |
< 5.12.8 | 5.12.8 |
| GHSA-fwww-cp23-7f5g Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce |
Medium EPSS 0.45% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-962x-ccwf-8x6p Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities |
High EPSS 0.52% |
< 5.12.8 | 5.12.8 |
| GHSA-962x-ccwf-8x6p Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities |
High EPSS 0.52% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-3g44-3m7x-cgg2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` |
Critical EPSS 0.68% |
< 5.12.8 | 5.12.8 |
| GHSA-3g44-3m7x-cgg2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` |
Critical EPSS 0.68% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-8xjq-pr36-ccgf Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets |
Medium EPSS 0.36% |
< 5.12.8 | 5.12.8 |
| GHSA-8xjq-pr36-ccgf Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets |
Medium EPSS 0.36% |
>= 5.13.0, < 5.13.2 | 5.13.2 |
| GHSA-2g95-6x5q-xjwj Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection |
Critical EPSS 1.12% |
< 5.12.7 | 5.12.7 |
| GHSA-vmwp-vh32-rj75 Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override |
Critical EPSS 0.98% |
< 5.12.7 | 5.12.7 |
| GHSA-524g-x36v-9wm6 Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` |
Critical EPSS 1.12% |
< 5.12.7 | 5.12.7 |
| GHSA-w5r6-mcgq-7pq4 Yamcs has No Rate Limiting on Authentication Endpoint |
Critical EPSS 2.06% |
< 5.12.7 | 5.12.7 |
| GHSA-p2rj-mrmc-9w29 Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints |
Medium EPSS 1.06% |
< 5.12.7 | 5.12.7 |
| GHSA-cqh3-jg8p-336j Yamcs Vulnerable to LDAP Injection in LdapAuthModule |
Medium EPSS 1.03% |
< 5.12.7 | 5.12.7 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor