Azure Security Vulnerabilities

CVE-2024-2003

Local privilege escalation vulnerability allowed an attacker to misuse ESET's file operations during a restore operation from...

CVE-2024-37325

Azure Science Virtual Machine (DSVM) Elevation of Privilege...

CVE-2024-35255

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege...

CVE-2024-35254

Azure Monitor Agent Elevation of Privilege...

CVE-2024-35253

Microsoft Azure File Sync Elevation of Privilege...

CVE-2024-35252

Azure Storage Movement Client Library Denial of Service...

CVE-2024-4706

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-30060

Azure Monitor Agent Elevation of Privilege...

CVE-2024-3744

A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when....

CVE-2024-30053

Azure Migrate Cross-Site Scripting...

CVE-2024-29993

Azure CycleCloud Elevation of Privilege...

CVE-2024-29990

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege...

CVE-2024-29992

Azure Identity Library for .NET Information Disclosure...

CVE-2024-29989

Azure Monitor Agent Elevation of Privilege...

CVE-2024-29063

Azure AI Search Information Disclosure...

CVE-2024-28917

Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege...

CVE-2024-26193

Azure Migrate Remote Code Execution...

CVE-2024-21424

Azure Compute Gallery Elevation of Privilege...

CVE-2024-20685

Azure Private 5G Core Denial of Service...

CVE-2024-29195

The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to...

CVE-2024-26203

Azure Data Studio Elevation of Privilege...

CVE-2024-21421

Azure SDK Spoofing...

CVE-2024-21400

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege...

CVE-2024-21330

Open Management Infrastructure (OMI) Elevation of Privilege...

CVE-2024-27099

The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect AMQP_VALUE failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit...

CVE-2024-0353

Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper...

CVE-2024-21397

Microsoft Azure File Sync Elevation of Privilege...

CVE-2024-21403

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege...

CVE-2024-21381

Microsoft Azure Active Directory B2C Spoofing...

CVE-2024-21376

Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution...

CVE-2024-21364

Microsoft Azure Site Recovery Elevation of Privilege...

CVE-2024-21329

Azure Connected Machine Agent Elevation of Privilege...

CVE-2024-20667

Azure DevOps Server Remote Code Execution...

CVE-2024-20679

Azure Stack Hub Spoofing...

CVE-2024-25110

The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the...

CVE-2024-21638

Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only...

CVE-2024-21643

IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the SignedHttpRequestprotocol or the SignedHttpRequestValidatoris vulnerable. Microsoft.IdentityModel trusts the jkuclaim.....

CVE-2024-20676

Azure Storage Mover Remote Code Execution...

CVE-2024-21646

Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause...

CVE-2023-5594

Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as...

CVE-2023-21751

Azure DevOps Server Spoofing...

CVE-2023-36019

Microsoft Power Platform Connector Spoofing...

CVE-2023-35624

Azure Connected Machine Agent Elevation of Privilege...

CVE-2023-35625

Azure Machine Learning Compute Instance for SDK Users Information Disclosure...

CVE-2023-48697

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in...

CVE-2023-48698

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in...

CVE-2023-48694

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include...

CVE-2023-48695

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and...

CVE-2023-48693

Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The...

CVE-2023-48696

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class,.....