Duraspace Dspace

Communities and collections administrators can escalate their privilege up to system administrator

Path traversal vulnerabilities in DSpace JSPUI submission upload

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Path traversal vulnerability in Simple Archive Format package import in DSpace

Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

URL Redirection to Untrusted Site in Dspace JSPUI

Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization