| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
| Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network. |
| Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. |
| Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. |
| Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. |
| Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. |
| Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. |
| Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. |
| Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. |
| Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. |
| Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. |
| Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. |
| Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
| Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. |
| The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1. |
| SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203. |
