N0Paew

User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

A signature bypass exists in the 'waiting-webhook' endpoint. The issue occurs because the system selects Send-and-Wait validation before normalizing an alternate node reference form. An attacker possessing an execution's resume token can approve waiting executions intended for other users, allowing downstream actions to run using the workflow owner's credentials, which may lead to command execution.

The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts into the application, which can then be executed by other users. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to an Authenticated Cross-Site Scripting (XSS) vulnerability. This means that an attacker who has authentication credentials for the system can potentially inject malicious scripts into the website, which could then be executed by other users, leading to unauthorized actions or data theft.

The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. It allows for Stored XSS via the upload of SVG and HTML files, due to an Unrestricted Upload of File with Dangerous Type vulnerability.