CVE-2023-24426

Jenkins Azure AD Plugin 303.va91ef20ee49f and earlier does not invalidate the previous session on login...

CVE-2021-21679

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2020-2119

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10318

Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system...

Alibaba Cloud Linux 3 : 0038: grafana (ALINUX3-SA-2024:0038)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0038 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-3128: Grafana is validating Azure AD...

PT-2025-17619 · Microsoft · Azure Ad Authentication

Name of the Vulnerable Software and Affected Versions: Microsoft Azure AD Authentication affected versions not specified Description: The issue concerns Microsoft Azure AD Authentication. No specific details about the nature of the issue are provided, but it is mentioned that more information, su...

Enable Azure AD Joined Device Management Functional Limitations

After configuring "Enable Azure AD Joined Device Management" stale machine objects are not automatically removed from AAD. - Made a custom aad role with the following permissions: microsoft.directory/devices/standard/read microsoft.directory/devices/delete - Assigned this role to the spn we use...

Citrix Daas - Authentication

Introduction This article is a summary of the top support articles and Product Documents related to Citrix DaaS Authentication Methods. The most commonly used support articles and guides are below. It is recommended that all customers refer to the product documentation for configuration related...

@pnp/nodejs (>=4.0.0 <=4.1.1-v4nightly.20240617), insomnia-plugin-azure-ad-authentication (=1.1.2) potentially affected by CVE-2024-35255 via @azure/msal-node (>=2.7.0 <=2.9.1)

@azure/msal-node NPM version =2.7.0, =4.0.0, =4.1.1-v4nightly.20240617 - insomnia-plugin-azure-ad-authentication =1.1.2 Source cves: CVE-2024-35255 Source advisory: OSV:GHSA-M5VV-6R4H-3VJ9...

CVE-2024-4706

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-4706 WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-4706

CVE-2024-4706 affects WordPress + Microsoft Office 365 / Azure AD | LOGIN (wpo365-login). It enables Stored XSS via the pintra shortcode in all versions up to 27.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor+ a...

CVE-2024-4706 WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

WordPress + Microsoft Office 365 / Azure AD | LOGIN < 28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

Description The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied...

BIT-GRAFANA-2023-3128

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

CentOS 9 : grafana-9.2.10-4.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the grafana-9.2.10-4.el9 build changelog. - account takeover possible when using Azure AD OAuth CVE-2023-3128 Note that Nessus has not tested for this issue but has instead relied only on t...

U.S. State Government Network Breached via Former Employee's Account

The U.S. Cybersecurity and Infrastructure Security Agency CISA has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee. "This allowed the threat actor to successfully authenticate to an internal...

Citrix DaaS: Single sign-on (SSO) not working after enabling FAS

In the DaaS environment, Single sign-onSSO did not work after enabling FAS, and users were prompted to enter credentials. FAS was enabled with Azure AD as IDP in a single-domain environment. Event ID 105, 120 and 121 logged on the FASServer,indicated that the Certificate wasissued by the Windows...

Oracle Linux 8 : grafana (ELSA-2023-6972)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6972 advisory. - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work - resolve CVE-2023-3128 grafana: account takeover possible when using Azure...

grafana security and enhancement update

9.2.10-7 - resolve RHEL-12649 - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work - testing is turned off due to test failures caused by testing date mismatch 9.2.10-6 - Add /usr/share/grafana to systemd-sysusers --replace 9.2.10-5 - resolve CVE-2023-3128 grafana:...