Azure-AccessPermissions

Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...

monkey365

...

CVE-2025-53786

استغلال CVE-2025-53786 يوفّر هذا المشروع استغلالًا إثباتي المفهوم PoC يستهدف ثغرة أمنية حرجة في عمليات النشر المختلطة لخادم Microsoft Exchange، والتي تم تحديدها باسم CVE-2025-53786. تسمح هذه الثغرة للمهاجم الذي يمتلك صلاحيات إدارية على خادم Exchange محلي بتصعيد الصلاحيات، وربما اختراق كلٍّ من...

caOptics

Note Progetto archiviato a causa del cambiamento delle priorità di sviluppo e del reindirizzamento dei miei sforzi nella community verso altre aree PoC, altri strumenti e demo/presentazioni, il progetto è impostato in sola lettura. CA Optics - Analizzatore dei gap di Azure AD Conditional Access...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC della recente vulnerabilità di brute force sulle password di Azure Active Directory scoperta da SecureWorks Descrizione Questo codice è una proof-of-concept della recentemente rivelata vulnerabilità di brute force sulle password di Azure Active Directory annunciata da...

EUVD-2026-63692

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-69851

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-69851

An SSRF vulnerability in Microsoft Entra ID (Azure Active Directory) allows an authorized attacker to elevate privileges over a network. CVSS 9.9 (critical) reflects network access, low complexity, and full confidentiality/integrity/availability impact. Exploitation status and patch details are n...

Microsoft Entra ID Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

PT-2026-79215

Name of the Vulnerable Software and Affected Versions Azure Active Directory affected versions not specified Description Server-side request forgery SSRF, a flaw where an attacker induces a server-side application to make requests to an unintended location, exists in Azure Active Directory. This...

EUVD-2026-54315

Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-50481

Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-50481

Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability

...

CVE-2026-50481

CVE-2026-50481 affects Azure Active Directory, where modification of assumed-immutable data (maid) enables an authorized attacker to elevate privileges over a network. The CVSS data indicates NETWORK attack vector, LOW access complexity, LOW privileges required, and HIGH confidentiality/integrity...

CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability

...

KLA91190 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

EUVD-2026-50216

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243

The CVE-2026-59243 vulnerability affects the apache-airflow-providers-fab package before 3.7.3, where the FAB auth manager’s Azure AD OAuth login defaulted verify_signature=False when decoding the ID token. An attacker who can present a forged or unsigned (alg:none) ID token to the OAuth callback...