CVE-2022-31191

DSpace JSPUI is vulnerable to Cross-Site Scripting due to improper escaping of displayed text in the spellcheck and autocomplete components (data-spell attribute escaped, but not the rendered text). Affected product: DSpace JSPUI (not XMLUI/7.x). Root cause: HTML escaping gaps in the JSPUI spellc...

CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

CVE-2022-31194

The CVE-2022-31194 issue affects DSpace JSPUI in the resumable upload path, where SubmissionController and FileUploadRequest allow path traversal to write files/directories on the server, limited to users with submitter privileges (not anonymous/basic users). Root cause: manipulating submission r...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31194 Source advisory: MEND:CVE-2022-31194...

CVE-2022-31194

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

CVE-2022-31193 URL Redirection to Untrusted Site in Dspace JSPUI

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

CVE-2022-31193 URL Redirection to Untrusted Site in Dspace JSPUI

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

CVE-2022-31193

DSpace JSPUI's controlled vocabulary servlet is vulnerable to an open redirect attack via crafted URLs. The issue affects the JSPUI component in DSpace, enabling redirection to attacker-controlled sites when a user clicks a malicious link. Patches exist for DSpace 5.x and 6.x (5.11 and 6.4); upgr...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31193 Source advisory: MEND:CVE-2022-31193...

CVE-2022-31193

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31193 Source advisory: MEND:CVE-2022-31193...

CVE-2022-31189 "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception including stack trace is available. Information in this stacktrace may ...

CVE-2022-31189

The CVE-2022-31189 issue affects the DSpace JSPUI component. When an internal system error occurs in the JSPUI, the application exposes the entire exception stack trace, which can disclose sensitive information. Affected product: DSpace JSPUI (UI for the repository app). Root cause: unsealed erro...

CVE-2022-31189

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception including stack trace is available. Information in this stacktrace may ...

CVE-2022-31189 "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception including stack trace is available. Information in this stacktrace may ...

CVE-2022-31189 "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception including stack trace is available. Information in this stacktrace may ...

CVE-2022-31190

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...

Design/Logic Flaw

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...

CVE-2022-31190 Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...