https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 16:07:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-5997 EUVD-2026-5997 https://cve.radiocsirt.org/vuln/euvd-2026-5997 https://cve.radiocsirt.org/vuln/fkie_cve-2024-38364 <p>DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user&#39;s browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.</p> <p>DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user&#39;s browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-38364 https://cve.radiocsirt.org/vuln/ghsa-94cc-xjxr-pwvf <p><strong>Affected:</strong> Maven: org.dspace:dspace-server-webapp</p> <p>### Impact In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user&#39;s browser _may_ execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack.</p> <p>This attack may only be initialized by a user who already has Submitter privileges in the repository. The submitter must upload the malicious HTML/XML/JavaScript file themselves. The attack itself would not occur until a visitor or logged-in user downloads the file or clicks on a download link shared by the attacker.</p> <p>If your site is running the frontend and backend from separate domains, CORS and CSRF protection built into DSpace help to limit the impact of the attack.</p> <p>If the repository is configured to only download HTML / XML / JavaScript Bitstreams using the [`Content-Disposition: attachment`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition) header, then the attack is no longer possible. See &#34;Workarounds&#34; below.</p> <p>### Patches The fix is included in both 8.0 and 7.6.2. Please upgrade to one of these versions, or manually apply one of the &#34;Workarounds&#34; below.</p> <p>If you are already running 7.6 or 7.6.1, then this vulnerability can be fixed via a configuration update in your `dspace.cfg` configuration file. See details in below.</p> <p>### Workarounds</p> <p>**DSpace sites running 7.6 or 7.6.1** can fix this issue by adding the following `webui.content_disposition_format` settings to their `dspace.cfg` (or `local.cfg`). Thes…</p> <p><strong>Affected:</strong> Maven: org.dspace:dspace-server-webapp</p> <p>### Impact In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user&#39;s browser _may_ execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack.</p> <p>This attack may only be initialized by a user who already has Submitter privileges in the repository. The submitter must upload the malicious HTML/XML/JavaScript file themselves. The attack itself would not occur until a visitor or logged-in user downloads the file or clicks on a download link shared by the attacker.</p> <p>If your site is running the frontend and backend from separate domains, CORS and CSRF protection built into DSpace help to limit the impact of the attack.</p> <p>If the repository is configured to only download HTML / XML / JavaScript Bitstreams using the [`Content-Disposition: attachment`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition) header, then the attack is no longer possible. See &#34;Workarounds&#34; below.</p> <p>### Patches The fix is included in both 8.0 and 7.6.2. Please upgrade to one of these versions, or manually apply one of the &#34;Workarounds&#34; below.</p> <p>If you are already running 7.6 or 7.6.1, then this vulnerability can be fixed via a configuration update in your `dspace.cfg` configuration file. See details in below.</p> <p>### Workarounds</p> <p>**DSpace sites running 7.6 or 7.6.1** can fix this issue by adding the following `webui.content_disposition_format` settings to their `dspace.cfg` (or `local.cfg`). Thes…</p> https://cve.radiocsirt.org/vuln/ghsa-94cc-xjxr-pwvf