Dspace cross-site scripting vulnerabilities

Dspace is an open source turnkey repository application from the DuraSpace community. A cross-site scripting vulnerability exists in versions of DSpace prior to 6.4, which stems from the fact that the actual displayed text is not escaped in dspace-jspui...

Dspace cross-site scripting vulnerabilities

Dspace is an open source turnkey repository application from the DuraSpace community. A cross-site scripting vulnerability exists in versions prior to DSpace 6.4, which stems from the Request a Copy feature in dspace-jspui failing to properly escape form submitted and stored values...

PT-2022-20601 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form, making item requests vulnerable to XSS attacks. Th...

PT-2022-20600 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not...

PT-2022-20603

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2021-22137 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2020-7021 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2020-7019 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2019-7614 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.apache.polygene.extensions:org.apache.polygene.extension.indexing-solr (3.0.0), org.apache.solr.solr:solr-clustering (1.4.1) +7 more potentially affected by CVE-2015-8797 via org.apache.solr:solr-core (1.4.1)

org.apache.solr:solr-core MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.polygene.extensions:org.apache.polygene.extension.indexing-solr 3.0.0 -...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace:dspace-solr (3.3.0.0) potentially affected by CVE-2015-8796 via org.apache.solr:solr (3.3.0)

org.apache.solr:solr MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr and may be impacted: - org.dspace:dspace-solr 3.3.0.0 Source cves: CVE-2015-8796 Source advisory: OSV:GHSA-4FXW-G29W-R8MX...

org.dspace:dspace-solr (>=3.5.0.0, <=3.5.0.1) potentially affected by CVE-2015-8796 via org.apache.solr:solr (3.5.0)

org.apache.solr:solr MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr and may be impacted: - org.dspace:dspace-solr =3.5.0.0, =3.5.0.1 Source cves: CVE-2015-8796 Source advisory: OSV:GHSA-4FXW-G29W-R8MX...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2014-6439 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2015-1427 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2015-4165 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2015-5531 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2018-3824 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2019-7611 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

dspace.mj.gov.br Cross Site Scripting vulnerability OBB-2482770

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...