Stories are collected automatically from public feeds, attributed to their original publishers and linked. Editors can remove anything. Always read the original source.
Corrected the CVSS Attack Vector metric from Network (AV:N) to Adjacent (AV:A) to reflect the requirement for Layer 2 network adjacency. The CVSS base score has decreased from 9.8...
Acknowledgement Updated
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.
Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.
Updated an acknowledgement. This is an informational change only.
The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of...
