intranda

9 results · Clear filters · Feed

• Medium 5.3
  CVE-2026-55465

  Goobi viewer: Solr injection via unvalidated region parameter in spatial search

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied re…

  intranda goobi-viewer-core
  Oct 23, 2026
• Medium 6.5
  CVE-2026-55463

  Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteE…

  intranda goobi-viewer-core
  Oct 23, 2026
• Medium 5.3
  CVE-2026-55444

  Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries wit…

  intranda goobi-viewer-core
  Oct 23, 2026
• Medium 6.8
  CVE-2026-46347

  Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the ac…

  intranda goobi-viewer-core
  Oct 23, 2026
• Medium 6.5
  CVE-2026-46346

  Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can…

  intranda goobi-viewer-core
  Oct 23, 2026
• Medium 5.3
  CVE-2026-55442

  Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before the…

  intranda goobi-viewer-core
  Oct 23, 2026
• Medium 6.1
  CVE-2023-29016

  Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user a…

  intranda goobi-viewer-core io.goobi.viewer:viewer-core Maven
  Apr 6, 2023
• Medium 6.1
  CVE-2023-29015

  Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a…

  intranda goobi-viewer-core io.goobi.viewer:viewer-core Maven
  Apr 6, 2023
• Medium 6.1
  CVE-2023-29014

  Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

  The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attac…

  intranda goobi-viewer-core io.goobi.viewer:viewer-core Maven
  Apr 6, 2023