dspace.2283337.n4.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1181939 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

org.dspace:dspace-spring-rest (7.0-preview-1) potentially affected by CVE-2019-17195 via com.nimbusds:nimbus-jose-jwt (6.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.dspace:dspace-spring-rest 7.0-preview-1 Source cves: CVE-2019-17195 Source advisory:...

High severity vulnerability that affects org.dspace:dspace-xmlui

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=5.0, <=5.4) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=5.0, <=5.4)

org.dspace:dspace-xmlui MAVEN version =5.0, =5.4.0, =5.0, =5.4 Source cves: CVE-2016-10726 Source advisory: OSV:GHSA-4M9R-5GQP-7J82...

org.dspace.modules:xmlui (>=3.0-rc1, <=3.5) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=3.0-rc1, <=3.5)

org.dspace:dspace-xmlui MAVEN version =3.0-rc1, =3.0-rc1, =3.5 Source cves: CVE-2016-10726 Source advisory: GHSA-4M9R-5GQP-7J82...

GHSA-4M9R-5GQP-7J82 High severity vulnerability that affects org.dspace:dspace-xmlui

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

org.dspace.modules:xmlui (>=4.0, <=4.1) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=4.0, <=4.1)

org.dspace:dspace-xmlui MAVEN version =4.0, =4.0, =4.1 Source cves: CVE-2016-10726 Source advisory: GHSA-4M9R-5GQP-7J82...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=5.0, <=5.4) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=5.0, <=5.4)

org.dspace:dspace-xmlui MAVEN version =5.0, =5.4.0, =5.0, =5.4 Source cves: CVE-2016-10726 Source advisory: GHSA-4M9R-5GQP-7J82...

org.dspace.modules:xmlui (>=4.0, <=4.1) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=4.0, <=4.1)

org.dspace:dspace-xmlui MAVEN version =4.0, =4.0, =4.1 Source cves: CVE-2016-10726 Source advisory: OSV:GHSA-4M9R-5GQP-7J82...

org.apache.polygene.extensions:org.apache.polygene.extension.indexing-solr (3.0.0), org.apache.solr.solr:solr-clustering (1.4.1) +7 more potentially affected by CVE-2017-3163 via org.apache.solr:solr-core (1.4.1)

org.apache.solr:solr-core MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.polygene.extensions:org.apache.polygene.extension.indexing-solr 3.0.0 -...

org.apache.jackrabbit:jackrabbit-core (>=2.0-beta1, <=2.0-beta3), org.apache.jackrabbit:jackrabbit-jca (>=2.0-beta1, <=2.0-beta3) +6 more potentially affected by CVE-2018-1339 via org.apache.tika:tika-parsers (0.4)

org.apache.tika:tika-parsers MAVEN version 0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tika:tika-parsers and may be impacted: - org.apache.jackrabbit:jackrabbit-core =2.0-beta1, =2.0-beta1, =2.0-beta1, =1.4.0, =1.4.0.1, =1.4.1.0,...

Dspace Directory Traversal Vulnerability

Dspace is an open source digital asset management system. The system is primarily used to manage and distribute data consisting of digital files or "bitstreams". A directory traversal vulnerability exists in the XMLUI functionality in Dspace versions prior to 3.6, 4.x versions prior to 4.5, and 5...

Directory traversal

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

CVE-2016-10726

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

CVE-2016-10726

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

org.dspace.modules:xmlui (>=4.0, <=4.1) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=4.0, <=4.1)

org.dspace:dspace-xmlui MAVEN version =4.0, =4.0, =4.1 Source cves: CVE-2016-10726 Source advisory: MEND:CVE-2016-10726...

CVE-2016-10726

CVE-2016-10726 affects the DSpace XMLUI component. It describes a directory traversal vulnerability in the XMLUI feature present in DSpace versions: before 3.6, 4.x before 4.5, and 5.x before 5.5. The underlying issue is traversal via the themes/ path when a URI contains two or more arbitrary cha...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=5.0, <=5.4) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=5.0, <=5.4)

org.dspace:dspace-xmlui MAVEN version =5.0, =5.4.0, =5.0, =5.4 Source cves: CVE-2016-10726 Source advisory: MEND:CVE-2016-10726...

CVE-2016-10726

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

CVE-2016-10726

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...