CVE Vulnerability Catalog

Vulnerability in the view_component framework (Ruby on Rails) versions 3.0.0 to 4.9.0. The system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. Fixed in version 4.9.0.

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.

Mistune prior to 3.2.1 contains an HTML Injection vulnerability in the math plugin. Inline and block math content is concatenated directly into HTML output without escaping, even when escape=True is set. This allows injection of arbitrary HTML.

In Lumiverse before version 0.9.7, the consumeNonce() function does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's sign-up fails before the before hook fires (e.g., due to a duplicate email), the nonce remains set and can be used by an attacker within a 10-second window to register an unauthorized account.

MaxKB version 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url). The endpoint uses application_id from the URL path without validating ownership, allowing attackers to perform operations under other applications’ policies.

MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services.

MaxKB before version 2.8.1 is vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch endpoint. Inconsistent URL parsing between the validation function and the HTTP client allows attackers to access internal network services.

PbootCMS version 3.2.11 contains a code injection vulnerability in its site configuration functionality.

Snipe-IT prior to version 8.4.1 has an open redirect vulnerability via an unvalidated HTTP Referer header stored in a session variable. Attackers can redirect users to malicious sites.

Snipe-IT prior to version 8.4.1 has an XSS vulnerability in the notes column for users with component view access. Insufficient escaping allows script injection.

In eventsource-encoder prior to 1.0.2, the event and id fields of an EventSourceMessage are not sanitized before serialization. An attacker controlling either field can inject arbitrary Server-Sent Events line terminators and forge additional SSE fields or entire messages.

The WpTravelly plugin for WordPress up to version 2.1.5 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

The WpBookingly plugin for WordPress up to version 1.2.9 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows exploiting incorrectly configured access control security levels. This affects versions from n/a through 2.0.1.

The Tiktok Feed plugin for WordPress up to version 1.0.24 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

SailingLab AppLock (com.alpha.applock) version 4.3.8 for Android allows a local attacker to execute arbitrary JavaScript via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This may lead to UI spoofing and privilege escalation.

In ThingsBoard up to version 4.3.1.1, a vulnerability in the getGatewayDockerComposeFile function of /api/v1/provision (YAML Handler component) allows code injection. Remote attack is possible but difficult.

In teableio teable up to version 1.9.x, the Sign-up component in apps/nextjs-app/src/features/auth/pages/LoginPage.tsx is vulnerable to cross site scripting via the redirect argument. The attack is remotely exploitable and the exploit is publicly available.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.

A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability, causing the application to crash and leading to a denial-of-service condition.