N0Paew

User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

يوجد تجاوز للتوقيع في نقطة النهاية 'waiting-webhook'. تحدث هذه المشكلة لأن النظام يختار التحقق من Send-and-Wait قبل تطبيع نموذج مرجع عقدة بديل. يمكن للمهاجم الذي يمتلك رمز استئناف التنفيذ الموافقة على عمليات تنفيذ في حالة انتظار مخصصة لمستخدمين آخرين، مما يسمح بتشغيل الإجراءات اللاحقة باستخدام بيانات اعتماد مالك سير العمل، وهو ما قد يؤدي إلى تنفيذ أوامر.

The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts into the application, which can then be executed by other users. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to an Authenticated Cross-Site Scripting (XSS) vulnerability. This means that an attacker who has authentication credentials for the system can potentially inject malicious scripts into the website, which could then be executed by other users, leading to unauthorized actions or data theft.

The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. It allows for Stored XSS via the upload of SVG and HTML files, due to an Unrestricted Upload of File with Dangerous Type vulnerability.