30 matches found
PurpleKeep
Descripción Con la creciente variedad de técnicas de ataque y el aumento simultáneo del número de reglas de detección ofrecidas por los EDR Detección y Respuesta de Puntos Finales y las creadas personalizadas, la necesidad de realizar pruebas funcionales constantes de las reglas de detección se h...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...
EUVD-2026-75184
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch...
GHSA-34R3-9M95-VQ73 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999
Open WebUI (a self-hosted AI platform) had a server-side request forgery (SSRF) vulnerability in backend/open_webui/retrieval/web/utils.py, affecting the POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search endpoints. The root cause was that Python's globally routable ...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999: Server-Side Request Forgery (SSRF)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Server-Side Request Forgery SSRF in Azure MCP Server allows an authorized attacker to elevate privileges over a network...
EUVD-2026-29578
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network...
GHSA-PRGG-RGFW-VR94 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-azure, linux-aws, linux-gcp, linux-vmware...
hays-london-azure-platform-2-poc
Hays London Azure Platform Engineer POC — AKS Operations & Pla...
Microsoft Azure DevOps 安全漏洞
Microsoft Azure DevOps is a team collaboration platform provided by the American company Microsoft. There is a security vulnerability in Microsoft Azure DevOps, which stems from insufficient credential protection. This vulnerability could allow unauthorized attackers to gain elevated privileges...
Microsoft Azure Arc Access Control Error Vulnerability
Microsoft Azure Arc is a storage system from Microsoft USA. that extends the Azure platform into your environment. Microsoft Azure Arc has an Access Control Error vulnerability that can be exploited by an attacker to elevate privileges...
CVE-2025-55697 Azure Local Elevation of Privilege Vulnerability
...
Microsoft raises the bar: A smarter way to measure AI for cybersecurity
ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...