PT-2022-20599 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 6.4 Description: The issue concerns the exposure of metadata on withdrawn items via the XMLUI "mets.xml" object, as long as the handle/URL of the withdrawn item is known. This affects the XMLUI component of DSpace. Th...

Dspace 安全漏洞

Dspace is an open source turnkey repository application from the DuraSpace community. A security vulnerability exists in DSpace versions prior to 6.4, which stems from the fact that when an "internal system error" occurs in dspace-jspui, the entire exception including the stack trace is available...

Dspace 跨站脚本漏洞

Dspace is an open source turnkey repository application from the DuraSpace community. A cross-site scripting vulnerability exists in versions prior to DSpace 6.4, which stems from the Request a Copy feature in dspace-jspui failing to properly escape form submitted and stored values...

DSpace 路径遍历漏洞

DSpace is an open source turnkey repository application from the DuraSpace community. A path traversal vulnerability exists in DSpace versions 4.0 through 6.3, which stems from a JSPUI in SubmissionController and FileUploadRequest that allows an attacker to create Tomcat/DSpace user-writable file...

PT-2022-20600 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not...

PT-2022-20597 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 6.4 Description: When an "Internal System Error" occurs in the JSPUI, the entire exception, including the stack trace, is available. Information in this stacktrace may be useful to an attacker in launching a more...

org.craftercms:crafter-studio2-engine (>=2.5.3 <=2.5.9), org.craftercms:crafter-studio2-studio (>=2.5.3 <=2.5.9) +2 more potentially affected by CVE-2015-8796 via org.apache.solr:solr (>=3.3.0 <=4.7.2)

org.apache.solr:solr MAVEN version =3.3.0, =2.5.3, =2.5.3, =3.3.0.0, =1.9.0, =1.10.0-beta2 Source cves: CVE-2015-8796 Source advisory: OSV:GHSA-4FXW-G29W-R8MX...

dspace.mj.gov.br Cross Site Scripting vulnerability OBB-2482770

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Communities and collections administrators can escalate their privilege up to system administrator

Impact Any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only existed in 7.0 and does not impact 6.x or below. Patches Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience. Workarounds In 7.0,...

org.dspace.modules:additions (=7.0-preview-1), org.dspace.modules:oai (=7.0-preview-1) +12 more potentially affected by CVE-2021-41189 via org.dspace:dspace-api (=7.0-preview-1)

org.dspace:dspace-api MAVEN version =7.0-preview-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:additions =7.0-preview-1 - org.dspace.modules:oai =7.0-preview-1 - org.dspace.modules:rdf...

GHSA-CF2J-VF36-C6W8 Communities and collections administrators can escalate their privilege up to system administrator

Impact Any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only existed in 7.0 and does not impact 6.x or below. Patches Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience. Workarounds In 7.0,...

CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

Design/Logic Flaw

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

CVE-2021-41189

CVE-2021-41189 affects DSpace 7.0; any community/collection administrator can escalate to system administrator due to a privilege elevation issue. The vulnerability is limited to 7.0 and is not present in 6.x or earlier. It is patched in 7.1. Workarounds in 7.0 include disabling community/collect...

CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...

DuraSpace 安全漏洞

Dspace is an open source turnkey repository application for the DuraSpace community. DuraSpace DSpace version 7.0 has a security vulnerability that allows any community or collection administrator to elevate their privileges to system administrator...

dspace.uniten.edu.my Cross Site Scripting vulnerability OBB-2144330

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

dspace.2283337.n4.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1181939 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...