CVE Vulnerability Catalog

In n8n, an open source workflow automation platform, prior to versions 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>

Fortinet FortiSandbox contains a command injection vulnerability (CWE-77) due to improper neutralization of special elements used in commands. A privileged attacker may execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects versions 5.2.0, 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all 4.2 versions.

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.

Improper handling of case sensitivity in MongoDB's configuration validation component may leave the authorization subsystem disabled by default during startup. An unauthenticated user with network access can perform arbitrary administrative operations, fully impacting data confidentiality, integrity, and availability.

A security issue in MongoDB Server allows an unauthenticated network user to cause denial of service on a specific type of replica set member. An assertion in read concern processing can be triggered without authentication, and its assumptions do not hold for all configurations, crashing the server process.

A use-after-free vulnerability exists in MongoDB's query execution memory tracking. An authenticated user with read privileges can trigger a write to freed heap memory via standard commands, causing a crash or memory corruption. No user interaction is required.

In MongoDB's LDAP authorization integration, pooled LDAP connections may retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may run under an unintended LDAP identity, leading to incorrect role assignments and potential privilege escalation beyond the intended policy.

NVIDIA Triton Inference Server for Linux has a missing authorization vulnerability that an attacker could exploit. Successful exploitation may lead to information disclosure, data tampering, and denial of service.

A vulnerability in the UEFI Shell implementation of Cisco UCS Servers could allow an authenticated attacker with user/admin role or an unauthenticated attacker with physical access to bypass UEFI Secure Boot and execute unauthorized software. This is due to memory write commands available in the UEFI Shell while Secure Boot is enabled, allowing manipulation of preboot environment and execution of unauthorized code.

NVIDIA Triton Inference Server for Linux contains a vulnerability that could allow an attacker to cause excessive iteration. Successful exploitation might lead to denial of service.

Snipe-IT before 8.7.0 has a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS using @import and url() to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

Snipe-IT before 8.7.0 streams SQL from an uploaded backup archive directly into the MySQL/MariaDB client without --binary-mode, so lines starting with backslash commands are interpreted as local shell commands. An authenticated superadministrator uploading a crafted ZIP and triggering restore without the clean parameter (not applied by default) can execute arbitrary OS commands as the web app user, exposing secrets and allowing modification of files and data. Version 8.7.0 adds --binary-mode.

Craft CMS before 5.10.12 has a remote code execution vulnerability in the element-index endpoint allowing authenticated content editors to instantiate arbitrary classes via the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] reaching ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.

Craft CMS before version 5.10.12 fails to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover.

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token, then delete the compromised record to destroy the victim's provider linkage.