Severity: Moderate CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected: yamcs-core < 5.12.7 and < 5.13.0 Fixed in: 5.12.7 / 5.13.0 Advisory: GHSA-cqh3-jg8p-336j Reporter: Daniel Miranda Barcelona (Excal1bur) Discovery date: 2026-04-20 Context If you’ve been following along, you already know YAMCS: the open-source mission…
Severity: Moderate CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected: sleapi-j < 5.1.7 Fixed in: sleapi-j 5.1.7 (commit 265118d) Advisory: GHSA-6g75-jwgj-hj8v Reporter: Daniel Miranda Barcelona (Excal1bur) Discovery date: 2026-03-26 This is the third YAMCS CVE. The first two were CVE-2026-44595 and CVE-2026-44596. What is…
Severity: MEDIUM (CVSS 4.3)Affected: yamcs-core < 5.12.7Fixed in: yamcs-core 5.12.7Advisory: GHSA-p2rj-mrmc-9w29 YAMCS has an IAM system with privilege levels. One of them is SystemPrivilege.ControlAccess supposed to gate access to user management endpoints. The IAM API has endpoints for listing users,…
Severity: MEDIUM (CVSS 5.3)Affected: yamcs-core < 5.12.7Fixed in: yamcs-core 5.12.7Advisory: GHSA-w5r6-mcgq-7pq4 YAMCS is an open-source mission control framework used in real space missions ESA’s OPS-SAT, various ground station deployments. If you’ve spent any time in the space software world, you’ve…
Vault Exfiltrator – USB Rubber Ducky Physical Exfiltration Payload Vault Exfiltrator is a payload designed for the USB Rubber Ducky that physically extracts password manager database files from a target Windows system. Unlike remote exfiltration payloads, it copies the files…
OrbiDump visualizes thousands of active satellites in real time using live TLE data from Celestrak. It combines a 3D Earth model with accurate orbit propagation (SGP4) and includes satellite metadata such as downlink frequencies, mode, and country. An integrated WebSDR panel lets you tune into amateur radio downlinks directly from the browser.
Vault Scanner – USB Rubber Ducky Payload Analysis This document describes Vault Scanner, a keystroke injection payload for the USB Rubber Ducky. It automates the discovery of password manager database files on Windows systems and exfiltrates the findings to a…
The sky and space have always been a kind of last frontier for humanity — an obsession carried since the first curious mind wondered whether something might be out there, and whether we could ever communicate with it. I remember…
First of all, hello — and honestly, what are you doing here? This is The Dumpster. A security research blog that nobody asked for, by Daniel Miranda Barcelona because at some point hacking satellites, pulling RF signals at 2am, and…
Coordinated report submitted through a national CERT. Context This section documents a real-world case of responsible security disclosure involving a public-sector system in Spain. The finding was identified through non-intrusive analysis and reported via an official channel, following the principles…