CVE-2022-31190 Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...

Dspace 跨站脚本漏洞

Dspace is an open source turnkey repository application from the DuraSpace community. A cross-site scripting vulnerability exists in versions of DSpace prior to 6.4, which stems from the fact that the actual displayed text is not escaped in dspace-jspui...

DSpace 信息泄露漏洞

DSpace is an open source turnkey repository application from the DuraSpace community. An information disclosure vulnerability exists in DSpace versions prior to 6.4, which stems from the fact that metadata for revoked projects in dspace-xmlui is exposed to the XMLUImets.xml object...

DSpace 输入验证错误漏洞

DSpace is an open source turnkey repository application from the DuraSpace community. An input validation error vulnerability exists in DSpace versions 4.0 through 6.3, which stems from the vulnerability of a JSPUI-controlled vocabulary servlet to an open redirection attack, where an attacker can...

PT-2022-20599 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 6.4 Description: The issue concerns the exposure of metadata on withdrawn items via the XMLUI "mets.xml" object, as long as the handle/URL of the withdrawn item is known. This affects the XMLUI component of DSpace. Th...

PT-2022-20601 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form, making item requests vulnerable to XSS attacks. Th...

DSpace 路径遍历漏洞

DSpace is an open source turnkey repository application from the DuraSpace community. A path traversal vulnerability exists in DSpace versions 4.0 through 6.3, which stems from a JSPUI in SubmissionController and FileUploadRequest that allows an attacker to create Tomcat/DSpace user-writable file...

Dspace 安全漏洞

Dspace is an open source turnkey repository application from the DuraSpace community. A security vulnerability exists in DSpace versions prior to 6.4, which stems from the fact that when an "internal system error" occurs in dspace-jspui, the entire exception including the stack trace is available...

PT-2022-20597 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 6.4 Description: When an "Internal System Error" occurs in the JSPUI, the entire exception, including the stack trace, is available. Information in this stacktrace may be useful to an attacker in launching a more...

Dspace 跨站脚本漏洞

Dspace is an open source turnkey repository application from the DuraSpace community. A cross-site scripting vulnerability exists in versions prior to DSpace 6.4, which stems from the Request a Copy feature in dspace-jspui failing to properly escape form submitted and stored values...

PT-2022-20600 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not...

dspace.mj.gov.br Cross Site Scripting vulnerability OBB-2482770

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Communities and collections administrators can escalate their privilege up to system administrator

Impact Any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only existed in 7.0 and does not impact 6.x or below. Patches Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience. Workarounds In 7.0,...

GHSA-CF2J-VF36-C6W8 Communities and collections administrators can escalate their privilege up to system administrator

Impact Any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only existed in 7.0 and does not impact 6.x or below. Patches Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience. Workarounds In 7.0,...

CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

Design/Logic Flaw

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

CVE-2021-41189

CVE-2021-41189 affects DSpace 7.0; any community/collection administrator can escalate to system administrator due to a privilege elevation issue. The vulnerability is limited to 7.0 and is not present in 6.x or earlier. It is patched in 7.1. Workarounds in 7.0 include disabling community/collect...

CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...