N0Paew

User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Existe um bypass de assinatura no endpoint 'waiting-webhook'. O problema ocorre porque o sistema seleciona a validação Send-and-Wait antes de normalizar um formulário de referência de nó alternativo. Um invasor que possua o token de retomada de uma execução pode aprovar execuções em espera destinadas a outros usuários, permitindo que ações subsequentes sejam executadas com as credenciais do proprietário do fluxo de trabalho, o que pode levar à execução de comandos.

The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts into the application, which can then be executed by other users. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to an Authenticated Cross-Site Scripting (XSS) vulnerability. This means that an attacker who has authentication credentials for the system can potentially inject malicious scripts into the website, which could then be executed by other users, leading to unauthorized actions or data theft.

The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. It allows for Stored XSS via the upload of SVG and HTML files, due to an Unrestricted Upload of File with Dangerous Type vulnerability.