| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Tanium addressed an improper access controls vulnerability in Patch. |
| Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system.
The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode.
If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact. |
| Tanium addressed an information disclosure vulnerability in Threat Response. |
| Tanium addressed an information disclosure vulnerability in Threat Response. |
| Tanium addressed an information disclosure vulnerability in Threat Response. |
| Tanium addressed an information disclosure vulnerability in Threat Response. |
| A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code. |
| Tanium addressed an information disclosure vulnerability in Threat Response. |
| Tanium addressed an improper output sanitization vulnerability in Tanium Appliance. |
| Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. |
| An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length. |
| Tanium addressed an incorrect default permissions vulnerability in Comply. |
| Tanium addressed an incorrect default permissions vulnerability in Partner Integration. |
| Tanium addressed an incorrect default permissions vulnerability in Patch. |
| Tanium addressed an incorrect default permissions vulnerability in Performance. |
| Tanium addressed an improper input validation vulnerability in Tanium Appliance. |
| Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems Based on Intel(R) 621A Chipset before version 16.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information. |
| School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests. Attackers can exploit the vulnerable parameter by injecting crafted SQL statements to potentially extract, modify, or delete database information. |
| School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server. |
