78 matches found
Design/Logic Flaw
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
PYSEC-2021-837
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
PYSEC-2021-836
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
PYSEC-2021-837
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
PYSEC-2021-836
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
PYSEC-2021-838
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
CVE-2021-43781 Permissions not properly checked in Invenio-Drafts-Resources
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default...
CVE-2021-43781
CVE-2021-43781 concerns Invenio-Drafts-Resources. The issue: versions prior to 0.13.7 and 0.14.6 fail to enforce permissions when publishing a record, allowing an authenticated user to publish draft records belonging to others via REST API if the record ID is known and the draft passes validation...
Invenio-Drafts-Resources 安全漏洞
Invenio-Drafts-Resources is a submission/deposit module for Invenio. It is used for research data management. A security vulnerability exists in Invenio-Drafts-Resources versions prior to 0.13.7 and 0.14.6, which stems from a failure to properly check permissions in the affected product. The...
invenio-previewer cross-site scripting vulnerability
invenio-previewer is an Invenio module for previewing files. A cross-site scripting vulnerability exists in versions prior to invenio-previewer 1.0.0a12. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability ...
Invenio-records Cross-Site Scripting Vulnerability
invenio-records is a metadata storage module. A cross-site scripting vulnerability exists in versions of invenio-records prior to 1.2.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...
Host Header Injection
invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...
Cross-site Scripting (XSS)
invenio-previewer is vulnerable to cross-site scripting XSS. It does not escape the user-uploaded file and directly render the file in the JSON, Markdown and iPython Notebook previewers, allowing an attacker to inject arbitrary Javascript into a victim's browser using a malicious file...
Cross-site Scripting (XSS)
invenio-records is vulnerable to cross-site scripting XSS. When an admin user views a new record uploaded by a user with permission to upload in the admin interface, it directly renders JSON output for the new record, allowing the user to inject and render any arbitrary malicious script to render...
Cross-site Scripting (XSS)
invenio-communities is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization of community.description in about.html...
CVE-2019-1020006
invenio-app before 1.1.1 allows host header injection...
CVE-2019-1020006
invenio-app before 1.1.1 allows host header injection...
CVE-2019-1020003
invenio-records before 1.2.2 allows XSS...