Browse CVEs

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose informatio…

Azure Entra ID Elevation of Privilege Vulnerability

Azure PlayFab Elevation of Privilege Vulnerability

Azure Entra ID Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose informatio…

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information…

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoo…

Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.

SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could p…

Azure Bot Service Elevation of Privilege Vulnerability

Azure Entra ID Elevation of Privilege Vulnerability

Azure Networking Elevation of Privilege Vulnerability

Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.

Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Azure OpenAI Elevation of Privilege Vulnerability

Azure Portal Elevation of Privilege Vulnerability

Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network.

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a …

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.

Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.