Ttzero25

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A one-byte out-of-bounds write occurs in the LwM2M JSON content formatter when copying a parsed JSON string into a buffer. The issue exists in the `get string()` function within `subsys/net/lib/lwm2m/lwm2m rw json.c` because the length guard allows strings with a length exactly equal to the buffer size. When such a string is processed, the subsequent NUL-termination writes a 0x00 byte immediately past the end of the buffer, potentially corrupting adjacent memory, such as resource values, length fields, or structure fields, which may lead to data corruption or a system crash. This can be triggered during a LwM2M WRITE operation where `do write op json()` parses a CoAP payload and `get string()` is called via `lwm2m write handler()` (specifically `engine get string()` in `subsys/net/lib/lwm2m/lwm2m message handling.c`) for a `LWM2M RES TYPE STRING` resource. The overflow affects either the resource instance's fixed data buffer `res inst->data ptr` or the engine validation buffer `msg->ctx->validate buf`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 **Description** A privilege escalation issue exists in Enterprise SSO instance-role provisioning. The provisioning path maps an Identity Provider (IdP) asserted role claim to an n8n global role but fails to prevent the assignment of the `global:owner` role. Consequently, an SSO-authenticated user whose instance-role claim resolves to `global:owner` is provisioned as an instance owner, granting full administrative control over workflows, credentials, users, and instance configuration. This issue is exploitable when Enterprise SSO is configured and instance-role provisioning is enabled via the `N8N SSO SCOPES PROVISION INSTANCE ROLE` variable. Exploitation requires the attacker to control the instance-role claim value issued by the IdP. **Recommendations** Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Disable instance-role provisioning by unsetting or setting `N8N SSO SCOPES PROVISION INSTANCE ROLE=false`. Audit IdP claim mappings to ensure no user-controllable attribute can supply the instance-role claim value. Restrict SSO access to fully trusted users only.