CVE-2022-31192

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item...

CVE-2022-31192 Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31191 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31191 Source advisory: MEND:CVE-2022-31191...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31191 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31191 Source advisory: MEND:CVE-2022-31191...

CVE-2022-31191 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI...

CVE-2022-31191 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI...

CVE-2022-31191

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI...

CVE-2022-31191 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI...

CVE-2022-31194

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31194 Source advisory: MEND:CVE-2022-31194...

CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31194 Source advisory: MEND:CVE-2022-31194...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31193 Source advisory: MEND:CVE-2022-31193...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31193 Source advisory: MEND:CVE-2022-31193...

CVE-2022-31193

DSpace JSPUI's controlled vocabulary servlet is vulnerable to an open redirect attack via crafted URLs. The issue affects the JSPUI component in DSpace, enabling redirection to attacker-controlled sites when a user clicks a malicious link. Patches exist for DSpace 5.x and 6.x (5.11 and 6.4); upgr...

CVE-2022-31193 URL Redirection to Untrusted Site in Dspace JSPUI

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

CVE-2022-31193

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (>=5.8.0, <=6.3.0) +1 more potentially affected by CVE-2022-31189 via org.dspace:dspace-jspui (>=4.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =4.0, =6.2.0, =5.8.0, =4.0, =6.3 Source cves: CVE-2022-31189 Source advisory: MEND:CVE-2022-31189...

CVE-2022-31189 "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception including stack trace is available. Information in this stacktrace may ...