CVE Vulnerability Catalog

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.

CAI Content Credentials is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. An attacker could exploit this to access sensitive files and directories outside the intended scope. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this to exhaust system resources, causing application unavailability. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this to exhaust system resources, causing application unavailability. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this to crash the application. Exploitation does not require user interaction.

The vulnerability related to improper encoding or escaping of output could result in a security feature bypass. A low-privileged attacker could leverage this to bypass security measures and gain limited unauthorized write access, causing limited disruption to availability. Exploitation does not require user interaction.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation requires user interaction – the victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.

Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 may allow an escalation of privilege. An unprivileged adversary with an unauthenticated user and low complexity attack may enable privilege escalation. This may occur via network access without user interaction. Impact on confidentiality, integrity, and availability is low.

Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 may allow an escalation of privilege. An unprivileged adversary with an unauthenticated user and low complexity attack may enable privilege escalation. This may occur via local access and requires active user interaction. Impact on confidentiality, integrity, and availability is low.

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning before version 45cd723 may allow an escalation of privilege. An unprivileged adversary with a privileged user and low complexity attack may enable privilege escalation. This may occur via local access and requires passive user interaction. Impact on confidentiality, integrity, and availability is high.

Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 may allow an escalation of privilege. An unprivileged adversary with an authenticated user and high complexity attack may enable privilege escalation. This may occur via local access and requires passive user interaction. Impact on confidentiality, integrity, and availability is high.