78 matches found
CVE-2019-1020005
invenio-communities before 1.0.0a20 allows XSS...
CVE-2019-1020005
CVE-2019-1020005 affects invenio-communities up to version 1.0.0a20, where two Jinja templates in the module allow cross-site scripting due to lack of input sanitization in community description and pages. The issue enables an attacker to inject scripts when creating a new community or editing fi...
CVE-2019-1020003
invenio-records before 1.2.2 allows XSS...
CVE-2019-1020003
CVE-2019-1020003 affects invenio-records (before 1.2.2), a metadata storage module. The root cause is lack of proper validation of client-side data by the WEB application, leading to cross-site scripting (XSS) (per CNVD/OSV/NVD entries and vendor advisories). Impact is that an attacker can execut...
CVE-2019-1020019
CVE-2019-1020019 affects the Invenio-Previewer component. The connected documents confirm a cross-site scripting (XSS) vulnerability in invenio-previewer versions prior to 1.0.0a12, caused by insufficient validation of client-side data by the WEB application. Exploitation would enable injection o...
CVE-2019-1020019
invenio-previewer before 1.0.0a12 allows XSS...
GHSA-MFV8-Q39F-MGFG Cross-site Scripting in invenio-communities
Cross-Site Scripting XSS vulnerability in Jinja templates Impact A Cross-Site Scripting XSS vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and...
Cross-site Scripting in invenio-communities
Cross-Site Scripting XSS vulnerability in Jinja templates Impact A Cross-Site Scripting XSS vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and...
Cross-site Scripting in invenio-previewer
Cross-Site Scripting XSS vulnerability in JSON, Markdown and iPython Notebook previewers Impact Several Cross-Site Scripting XSS vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or...
GHSA-J9M2-6HQ2-4R3C Cross-site Scripting in invenio-previewer
Cross-Site Scripting XSS vulnerability in JSON, Markdown and iPython Notebook previewers Impact Several Cross-Site Scripting XSS vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or...
GHSA-VXH3-MVV7-265J Cross-site scripting invenio-records
Cross-Site Scripting XSS vulnerability in administration interface Impact A Cross-Site Scripting XSS vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an...
GHSA-94MF-XFG5-R247 Invenio-App vulnerable to host header injection attack
APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...
Cross-Site Scripting (XSS)
Invenio is vulnerable to cross-site scripting XSS. It is exploitable because the search flash messages are not displayed as HTML by default...
Cross-Site Scripting (XSS)
Invenio is vulnerable to cross-site scripting XSS attacks. It is exploitable because the main flash messages are displayed as HTML by default...
Code injection
CDS Invenio 0.92.1 and earlier allows remote authenticated users to delete email notification alerts of arbitrary users via a modified internal UID...
CVE-2008-1627
CDS Invenio 0.92.1 and earlier allows remote authenticated users to delete email notification alerts of arbitrary users via a modified internal UID...
CVE-2008-1627
CVE-2008-1627 affects CDS Invenio 0.92.1 and earlier. The issue allows remote authenticated users to delete email notification alerts of arbitrary users by modifying an internal UID. This is the explicit vulnerability described in the connected CVE records. The documents do not provide a remediat...