Odgrso

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 **Description** A DOM-based cross-site scripting issue exists in the HTML preview, which renders execution output into an `iframe srcdoc` without the `sandbox` attribute. A sanitizer bypass allows injected scripts to execute with the same origin as the editor. This enables an account with `global:member` privileges to call authenticated APIs using the victim's session when the preview is opened. **Recommendations** Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Restrict instance access to fully trusted users only. Set the `N8N CONTENT SECURITY POLICY` environment variable to a policy that blocks inline scripts. Avoid exposing workflows that render externally-controlled input into the HTML node or binary HTML preview to untrusted users.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 **Description** A stored DOM cross-site scripting issue exists in the Resource Locator component. The component passes the workflow-persisted `cachedResultUrl` parameter to the `window.open()` function without validating the scheme. An attacker with privileges to create or edit workflows can include a malicious scheme, such as `javascript:`, in the `cachedResultUrl` variable. When a victim opens the crafted workflow and interacts with external links, the payload executes within the victim's browser. **Recommendations** Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Restrict workflow creation and editing permissions to fully trusted users only. Audit existing workflows for unexpected `cachedResultUrl` values containing non-HTTP(S) schemes.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.30.1 n8n versions prior to 2.29.8 **Description** The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens (JWTs), ignoring the actual role of the acting user. In environments where the Token Exchange feature and Public API are enabled, a low-privileged user with a valid external JWT from a trusted issuer can use the resulting access token to perform administrator-only Public API operations, including user creation, user deletion, and role escalation. Furthermore, if unverified Community Package installation is enabled, this can lead to remote code execution. **Recommendations** Update to version 2.30.1 or later. Update to version 2.29.8 or later. Disable the Token Exchange feature by setting `N8N TOKEN EXCHANGE ENABLED=false` or `N8N ENV FEAT TOKEN EXCHANGE=false`. Restrict Public API access at the network level to trusted clients only. Disable unverified Community Package installation by setting `N8N UNVERIFIED PACKAGES ENABLED=false`.

**Name of the Vulnerable Software and Affected Versions** Mastodon versions 4.3.0 through 4.5.10 Mastodon versions 4.4.0 through 4.4.17 **Description** Mastodon is a free, open-source social network server based on ActivityPub. A flaw in the definition of the `attributionDomains` JSON-LD term makes Linked Data Signatures on the `toot:attributionDomains` property ineffective. This allows an attacker to arbitrarily modify the `attributionDomains` value of a legitimately signed Update activity and bypass signature verification, potentially leading to false attribution claims. **Recommendations** Update to version 4.5.11. Update to version 4.4.18.

Name of the Vulnerable Software and Affected Versions Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 Description Vite, a frontend tooling framework for JavaScript, allows retrieval of files blocked by `server.fs.deny` (such as .env and *.crt files) with HTTP 200 responses when specific query parameters like ?raw, ?import&raw, or ?import&url&inline are appended to the request. This occurs when the Vite dev server is exposed to the network and sensitive files are both allowed by `server.fs.allow` and denied by `server.fs.deny`. Recommendations Vite versions 7.1.0 through 7.3.1 should be updated to version 7.3.2 or later. Vite versions 8.0.0 through 8.0.4 should be updated to version 8.0.5 or later.

Name of the Vulnerable Software and Affected Versions Vite versions 6.0.0 through 6.4.1, 7.3.2, and 8.0.5 Description The Vite dev server improperly handles .map requests for optimized dependencies. It resolves file paths and calls readFile without restricting '../' segments in the URL, potentially allowing bypass of the server.fs.strict allow list and retrieval of .map files located outside the project root if they are valid source map JSON. This could expose sensitive content if the server is exposed to the network and predictable paths to .map files exist. Recommendations Update to Vite version 6.4.2 or later, 7.3.2, or 8.0.5.

Name of the Vulnerable Software and Affected Versions Vite versions 6.0.0 through 6.4.1, 7.3.2, and 8.0.5 Description Vite, a frontend tooling framework for JavaScript, had a flaw where the `server.fs` check was not enforced for the `fetchModule` method exposed in the Vite dev server’s WebSocket. If a connection to the Vite dev server’s WebSocket could be established without an Origin header, an attacker could invoke `fetchModule` via the custom WebSocket event `vite:invoke` and combine `file://...` with `?raw` (or `?inline`) to retrieve the contents of arbitrary files on the server as a JavaScript string. The access control enforced in the HTTP request path was not applied to this WebSocket-based execution path. This could allow exposure of arbitrary files on the server, including those in the development machine, CI environment, or container. Recommendations Update Vite to version 6.4.2 or later, 7.3.2, or 8.0.5.

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.0 Description A Server-Side Request Forgery (SSRF) protection bypass exists in Directus. The IP address validation used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. The validation logic failed to normalize IPv4-Mapped IPv6 addresses before checking them against the deny-list, allowing an attacker to bypass the restriction. This could allow an authenticated user (or an unauthenticated user if public file-import permissions are enabled) to perform SSRF attacks against internal services or cloud instance metadata endpoints. Recommendations Update to version 11.16.0 or later.

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.17.0 Description The Directus file management API contains a broken access control issue that allows authenticated users to overwrite files belonging to other users by manipulating the `filename disk` parameter in the `PATCH /files/{id}` endpoint. By setting this value to match the storage path of another user's file, an attacker can overwrite the file's content and manipulate metadata fields like `uploaded by` to hide the tampering. This can lead to unauthorized file overwrites, potential remote code execution if the storage backend is shared with the extensions location, and data integrity compromise. Recommendations Update to version 11.17.0 or later.

Name of the Vulnerable Software and Affected Versions Directus (affected versions not specified) Description When `GRAPHQL INTROSPECTION=false` is configured, Directus blocks standard GraphQL introspection queries but the `/graphql/system` endpoint's `server specs graphql` resolver returns an equivalent SDL representation of the schema. This bypasses introspection controls, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level. Administrators setting `GRAPHQL INTROSPECTION=false` had a false sense of security, as schema information remained accessible via the SDL endpoint. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zulip versions 1.4.0 through 11.5 **Description** An issue exists where attachments from web-public streams remain accessible anonymously even after spectator access is disabled via `enable spectator access` or `WEB PUBLIC STREAMS ENABLED`. Additionally, the '/users/me/<stream id>/topics' endpoint remains reachable anonymously, allowing unauthorized retrieval of topic history for web-public streams. **Recommendations** Update to version 11.6.

**Name of the Vulnerable Software and Affected Versions** Connect-CMS versions 1.x through 1.41.0 Connect-CMS versions 2.x through 2.41.0 **Description** An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Insufficient authorization checks could allow processing associated with non-public pages to be executed, potentially allowing the contents and attachments of non-public pages to be obtained by a third party. **Recommendations** For the 1.x series, update to version 1.41.1 or later. For the 2.x series, update to version 2.41.1 or later.

**Name of the Vulnerable Software and Affected Versions** Connect-CMS versions 1.x through 1.41.0 Connect-CMS versions 2.x through 2.41.0 **Description** Connect-CMS is a content management system. An improper authorization issue exists in the My Page profile update feature, potentially allowing modification of arbitrary user information. Exploitation requires an attacker to access the affected functionality as an authenticated user, which could lead to account takeover. **Recommendations** For the 1.x series, update to version 1.41.1 or later. For the 2.x series, update to version 2.41.1 or later.

**Name of the Vulnerable Software and Affected Versions** Connect-CMS versions 1.35.0 through 1.41.0 Connect-CMS versions 2.35.0 through 2.41.0 **Description** A DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Exploitation requires an authenticated user and could allow arbitrary script execution in the victim's browser, potentially leading to unauthorized actions or information theft. The issue is due to how saved names were rendered. **Recommendations** Connect-CMS versions 1.35.0 through 1.41.0: Update to version 1.41.1 or later. Connect-CMS versions 2.35.0 through 2.41.0: Update to version 2.41.1 or later.

**Name of the Vulnerable Software and Affected Versions** Connect-CMS versions 1.x through 1.41.0 Connect-CMS versions 2.x through 2.41.0 **Description** A Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Exploitation requires privileges that allow use of the page management screen and may allow access to internal destinations, potentially resulting in information disclosure. Server-Side Request Forgery (SSRF) is a web security issue that allows an attacker to cause the server to make requests to unintended locations. **Recommendations** Update to Connect-CMS version 1.41.1 or later. Update to Connect-CMS version 2.41.1 or later.

**Name of the Vulnerable Software and Affected Versions** Connect-CMS versions prior to 1.41.1 Connect-CMS versions prior to 2.41.1 **Description** Connect-CMS is a content management system. An authenticated user may be able to execute arbitrary code in the Code Study Plugin. If exploited, this could lead to code execution on the server or information disclosure. **Recommendations** Update Connect-CMS to version 1.41.1 or later. Update Connect-CMS to version 2.41.1 or later.

**Name of the Vulnerable Software and Affected Versions** Connect-CMS versions 1.x through 1.41.0 Connect-CMS versions 2.x through 2.41.0 **Description** A Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. If exploited, arbitrary script could run in an administrator's browser, potentially leading to unauthorized actions or information theft. **Recommendations** Update to Connect-CMS version 1.41.1 or later. Update to Connect-CMS version 2.41.1 or later.

**Name of the Vulnerable Software and Affected Versions** ERP versions prior to 16.8.0 ERP versions prior to 15.100.0 **Description** The software contains a flaw due to insufficient parameter validation, leading to time-based and boolean-based blind SQL injection in certain endpoints. This allows attackers to potentially infer database information. **Recommendations** Update to version 16.8.0 or later. Update to version 15.100.0 or later.

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions 2.68.0 through 3.4.7 ZITADEL version 4.12.2 **Description** ZITADEL is an open source identity management platform. Versions 2.68.0 through before 3.4.8 and 4.12.2 contain an issue where requests to the System for Cross-domain Identity Management (SCIM) API with URL-encoded path values bypassed necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information, including names, email addresses, phone numbers, addresses, external IDs, and roles. Data manipulation or deletion was prevented due to additional checks. The API endpoint is susceptible to this issue. The vulnerable parameter is the URL-encoded path value. **Recommendations** ZITADEL versions 2.68.0 through 3.4.7 should be updated to version 3.4.8 or later. ZITADEL version 4.12.2 should be used.

**Name of the Vulnerable Software and Affected Versions** Frappe versions prior to 14.100.2 Frappe versions prior to 15.101.0 Frappe versions prior to 16.10.0 **Description** Frappe is a full-stack web application framework. Due to insufficient validation and inadequate permission checks, users could modify other users' private workspaces. Specifically crafted requests could result in stored cross-site scripting (XSS). **Recommendations** Update to Frappe version 14.100.2 or later. Update to Frappe version 15.101.0 or later. Update to Frappe version 16.10.0 or later.