CVE Vulnerability Catalog

Activepieces prior to 0.80.0 has a vulnerability in the code compilation pipeline where a step name can contain shell metacharacters, allowing arbitrary command execution during compilation. An authenticated user can execute commands as the worker process.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and the component is restricted to an administrative network zone by default.

Cross-site Scripting (XSS) vulnerability in ColdFusion that could result in arbitrary code execution in the context of the current user. Requires user interaction (opening a malicious file). Scope is changed.

Incorrect Authorization vulnerability in ColdFusion that could result in a security feature bypass. An attacker can gain limited unauthorized read and write access, causing limited disruption to availability. No user interaction required.

Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

Improper neutralization of input during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Improper control of generation of code (code injection) in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

A code injection vulnerability in Visual Studio Code allows an unauthorized attacker to execute code over a network.

An OS command injection vulnerability in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

An integer overflow vulnerability in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.