CVE Vulnerability Catalog

In n8n before version 1.123.64, custom HTTP header credentials in LLM sub-node execution data are not properly masked, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read these credentials.

In n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch), the DELETE /${restEndpoint}/test-webhook/:id endpoint is registered before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

Some Hikvision cameras have an information disclosure vulnerability that allows unauthenticated attackers to obtain partial information from the device's memory.

Some Hikvision cameras have a privilege escalation vulnerability. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.

A path traversal vulnerability was found in the Ansible Lightspeed Model Context Protocol (MCP) server, allowing an attacker to manipulate an AI agent through indirect prompt injection. The attacker can cause the server to write files to unauthorized locations on the user's system, potentially leading to exposure of sensitive host information and execution of malicious commands, possibly resulting in full system compromise.

In OpenCanary 0.9.8 (MongoDB module), a denial-of-service vulnerability exists due to excessive allocation. Only version 0.9.8 is affected.

In AWX, the websocket event consumer performs RBAC authorization checks only for event groups mapped in the consumer_access() function. Three event groups (inventory_update_events, project_update_events, system_job_events) are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these groups and receive stdout output from jobs belonging to organizations they have no access to.

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 5.0.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, making it possible for unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was partially patched in version 5.0.4.

An off-by-one error in the SBC frame decoder of the sbc library (BlueZ SBC codec) allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. An adjacent Bluetooth attacker can read a single byte of adjacent heap memory.

The Joomla extension JoomShopping versions below 5.9.3 is vulnerable to Reflected XSS in the product frontend controller. An attacker can inject malicious scripts that execute in the victim's browser.

In the Online Registration and Workflow Management System by Universe Software, there is an authorization bypass vulnerability through a user-controlled key, allowing exploitation of client trust. The issue affects versions up to 12022026.

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Timetics WordPress plugin before version 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

A vulnerability was identified in umijs umi up to version 4.6.63 allowing OS command injection. The issue is in the git.getFileCreateInfo function in packages/utils/src/getFileGitIno.ts. A patch is available in version 4.6.64.

In itsourcecode Hospital Management System 1.0, a vulnerability exists in an unknown function of the file /prescription.php. Manipulation of the editid argument results in SQL injection. The attack can be executed remotely, and the exploit is publicly available.

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Resource exhaustion persists beyond query completion, and repeated requests can fully exhaust available query worker resources, rendering ES|QL queries unavailable until the node is restarted.

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

In jsforce up to version 3.10.16, there is an OS command injection vulnerability in the _execCommand function of lib/registry/sfdx.js in the SFDX Connection Registry component. Local access is required. The exploit is public, and the project has not responded.

QUSETIONS MiniCode-Python version 0.1.0 has an OS command injection vulnerability in the subprocess.Popen function. The attack is difficult due to high complexity but possible remotely. Fixed in version 0.1.0-rc1 (commit 9d868dc).

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.