EAST

Herramienta de Seguridad Extensible de Azure Herramienta de Seguridad Extensible de Azure referida posteriormente como E.A.S.T es una herramienta para evaluar controles de seguridad de Azure y, en cierta medida, de Azure AD. El caso de uso principal de EAST es la recopilación de datos de segurida...

msspray

Nota: Este repositorio ya no está en desarrollo msspray.py MSSpray se utiliza para realizar ataques de password spray contra Azure AD, así como para validar la implementación de MFA en los endpoints de Azure y Office 365 ------------------------------------------------------------ | ;--- Comprueb...

Check-AAD-Connect-for-CVE-2021-36949-vulnerability

El script comprobará si tu Azure AD Connect está ejecutando una versión afectada por la vulnerabilidad descrita en CVE-2021-36949. Las versiones afectadas son 1.6.4.0 y 2.0.3.0. Ejecuta el script en el servidor que aloja la instalación de AAD Connect. El script también comprueba si la función de...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

EUVD-2026-93779

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2026-9226

An authentication bypass vulnerability exists in the Azure AD external login flow of Devolutions Server version 2026.3.7.0 and earlier . A remote attacker can exploit this by capturing and replaying a login-session token exposed in a redirect URL, potentially leading to full account takeover . No...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

PT-2026-107110

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

AADOutsider-py

AADOutsider-py Intro This tool is a rewrite of the recon as outsider part of AADInternals. It reimplements the following killchains functions of AADInternals and all their submethods: Invoke-AADIntReconAsOutsider Invoke-AADIntUserEnumerationAsOutsider Install pip3 install...

AzureADAssessment

Microsoft Azure AD Assessment Assessor Guide If you are a Microsoft employee or partner performing the assessment for a customer please see the Wiki for the Assessment Guide. Install from the PowerShell Gallery If you run into any errors please see the FAQ section at the end of this document...

CVE-2026-59243

CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass Korean: README.ko.md Apache advisory: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl published 2026-07-29 CVE record: https://vulners.com/cve/CVE-2026-59243 Fixed in: apache-airflow-providers-fab==3.7.3 Class:...

CVE-2023-3128

CVE-2023-3128 Para verificar si un dominio es vulnerable a CVE-2023-3128, que implica un bypass de autenticación en Grafana debido a la validación de afirmación de correo electrónico de Azure AD, puedes usar el siguiente script de Python: !/usr/bin/env python3 import requests import argparse def...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource (crlsa-2023_4030)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234030 advisory. grafana: account takeover possible when using Azure AD OAuth CVE-2023-3128 Tenable has extracted the preceding description block directly from the CIQ security...

CVE-2026-84458

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

EUVD-2026-87261

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service allows attackers to bypass authentication by using a user-controlled key, enabling them to escalate their privileges.

The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service relates to the bypassing of authentication processes by using a user-controlled key. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

CVE-2026-75156

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...