446 matches found
monkey365
Monkey365 is an open-source security assessment framework for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals, consultants, administrators, and incident responders identify misconfigurations, review cloud security posture, and evaluate environments against industry...
CVE-2026-121390
A flaw was found in FreeRDP. A malicious remote gateway can cause a Denial of Service DoS by returning a crafted response that omits an expected server certificate field. FreeRDP fails to properly validate the missing field during Azure Active Directory AAD gateway communications, leading to an...
Azure-AccessPermissions
Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...
CVE-2025-53786
CVE-2025-53786 Exploit This project provides a proof-of-concept PoC exploit targeting a critical vulnerability in Microsoft Exchange Server hybrid deployments, identified as CVE-2025-53786. This vulnerability allows an attacker with administrative access to an on-premises Exchange server to...
aad-sso-enum-brute-spray
aad-sso-enum-brute-spray POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln Description This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks here is the Ars Technica article that...
caOptics
Note Project archived due to shifting development priorities and refocusing my community efforts to other areas PoCs, other tools and demos/presentation, project is set to read-only. CA Optics - Azure AD Conditional Access Gap Analyzer What is Conditional Access? Notes for early testers Release...
CVE-2026-85916
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
CVE-2026-85916
A vulnerability in Azure Active Directory allows an unauthorized attacker to perform a local disclosure of private personal information. The vulnerability is categorized under CWE-359 , which involves the exposure of private personal information to an unauthorized actor. The CVSS 3.1 score is 6.2...
EUVD-2026-99625
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
Azure Active Directory Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
PT-2026-112853
Name of the Vulnerable Software and Affected Versions Azure Active Directory affected versions not specified Description An issue in Azure Active Directory allows an unauthorized actor to disclose private personal information locally, which can lead to the acquisition of sensitive information and...
Microsoft Windows: CVE-2026-85916: Azure Active Directory Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
CVE-2026-85916: Exposure of Private Personal Information to an Unauthorized Actor
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
CVE-2026-83711: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
Microsoft Entra ID Deserialization Code Execution
The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to deficiencies in deserialization mechanisms. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
EUVD-2026-63692
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69851
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69851
An SSRF vulnerability in Microsoft Entra ID (Azure Active Directory) allows an authorized attacker to elevate privileges over a network. CVSS 9.9 (critical) reflects network access, low complexity, and full confidentiality/integrity/availability impact. Exploitation status and patch details are n...