Vulnerabilidades

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Redis Enterprise Elevation of Privilege Vulnerability

Azure PlayFab Elevation of Privilege Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network.

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to…

The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with…

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups from the group display name when himmelblau.conf `id_attr_map = name` (the default configuration). Because Microsoft Entra ID allows multiple groups with the same `displayName`…

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.

Azure Bot Service Elevation of Privilege Vulnerability

Azure Networking Elevation of Privilege Vulnerability

Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing…

Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.

Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network.

Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.

Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.

Azure Portal Elevation of Privilege Vulnerability

Azure OpenAI Elevation of Privilege Vulnerability

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tasks service leaks an Intune service access token to the system journal. This short-lived token can be used to detect the host's Intune compliance status, and may…

Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network.