All CVEs — page 364 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw is a NoSQL injection vulnerability in the MongoDB Chat Memory node of n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1, allowing unauthenticated attackers to access and manipulate conversation histories.
The flaw is a stored DOM cross-site scripting vulnerability in n8n, allowing workflow authors to inject malicious scripts that can execute arbitrary JavaScript in the editor origin when other users interact with the node dropdown.
This vulnerability allows attackers to inject filter expressions, leading to unauthorized data access, modification, or deletion. It matters because it can result in complete data compromise.
This vulnerability allows attackers with editor access to shared workflows to tamper with credentials by exploiting duplicate node IDs, leading to unauthorized access to sensitive information.
The flaw allows attackers to decrypt and exfiltrate plaintext secrets by referencing arbitrary credential IDs, bypassing ownership verification.
This vulnerability allows unauthenticated attackers to execute arbitrary SQL during the first-run setup mode, enabling them to plant admin users and session tokens, leading to full application takeover.