Intranda goobi-viewer-core path traversal vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 24.03 up to but not including 26.05. This vulnerability arises because ExternalFilesDownloader.getFilename extracts the target filename from the Content-Disposition response header provided by the server and passes it...

Intranda goobi-viewer-core authorization issue vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 24.03 up to but including 26.05. This vulnerability arises because the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket accepts download requests from unauthenticated users, potentially leading to...

Intranda goobi-viewer-core input validation error vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 25.08 up to but not including 26.05. This vulnerability stems from the auth/login and auth/token endpoints in IIIF Auth 2.0 accepting unvalidated origin query parameters in AuthorizationFlowResource. These parameters are...

Intranda goobi-viewer-core encryption issue vulnerability

Versions of Intranda Goobi Viewer Core prior to 26.05 contain a security vulnerability. This vulnerability arises because, when accessing the password reset link, a predictable method is used to generate a new password. Due to insufficient entropy, this may allow attackers to brute-force the...

Intranda Goobi Viewer Core Cross-site Scripting Vulnerability

Intranda Goobi Viewer Core is a Web-based digital library system from Intranda, Germany. A cross-site scripting vulnerability exists in Intranda Goobi Viewer Core versions prior to 23.03, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability. The vulnerability can b...

Intranda Goobi Viewer Core Cross-site Scripting Vulnerability

Intranda Goobi Viewer Core is a Web-based digital library system from Intranda, Germany. A cross-site scripting vulnerability exists in Intranda Goobi Viewer Core prior to version 23.03, which stems from a cross-site scripting XSS vulnerability in the user comments feature. The vulnerability can ...