Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 544

Export CSV
CVE-2024-29993

Azure CycleCloud Elevation of Privilege Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2024-29063

Azure AI Search Information Disclosure Vulnerability

Azure AI Search Information Disclosure Vulnerability

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Ai Search
CVE-2024-26193

Azure Migrate Remote Code Execution Vulnerability

Azure Migrate Remote Code Execution Vulnerability

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Migrate
CVE-2024-30053

Azure Migrate Cross-Site Scripting Vulnerability

Azure Migrate Cross-Site Scripting Vulnerability

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Migrate
CVE-2022-39327

Improper Control of Generation of Code ('Code Injection') in Azure CLI

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Microsoft
Products
Azure Command-line Interface Windows
CVE-2017-8613

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."

CVSS 3.0 · 8.1 High EPSS 3.6% KEV · Not listed
Vendors
Microsoft
Products
Azure Active Directory Connect
CVE-2022-23551

AAD Pod Identity obtaining token with backslash

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. This issue has been fixed and has been included in AAD Pod Identity release version 1.8.13. If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the version 1.8.13 release.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Ad Pod Identity