CVE Vulnerability Catalog

No CWE for this issue in AMD Zen allows an authorized attacker to disclose information locally.

No CWE for this issue in AMD Zen allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.

Server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.

CAI Content Credentials is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. An attacker could exploit this to access sensitive files and directories outside the intended scope. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this to exhaust system resources, causing application unavailability. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a security feature bypass. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this to exhaust system resources, causing application unavailability. Exploitation does not require user interaction.

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this to crash the application. Exploitation does not require user interaction.

The vulnerability related to improper encoding or escaping of output could result in a security feature bypass. A low-privileged attacker could leverage this to bypass security measures and gain limited unauthorized write access, causing limited disruption to availability. Exploitation does not require user interaction.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation requires user interaction – the victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.