CVE-2017-8613: Weak Password Recovery Mechanism for Forgotten Password

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."...

PT-2017-18439

Name of the Vulnerable Software and Affected Versions Azure AD Connect affected versions not specified Description The issue concerns a misconfiguration during the enablement of Azure AD Connect Password writeback, which can allow an attacker to reset passwords and gain unauthorized access to...

Microsoft Issues 'Important' Security Fix for Azure AD Connect

Microsoft is warning customers of a bug in its Azure Active Directory Connect product that could allow an adversary to escalate privileges and reset passwords and gain unauthorized access to user accounts. The advisory 4033453 was issued Tuesday via Microsoft’s TechNet website for the vulnerabili...

Authentication Bypass

Overview Affected versions of passport-azure-ad do not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token. Recommendation Version 1.x: Update to version 1.4.6 or later. Version 2.x: Update to version 2.0.1 or later. References - Securi...

CVE-2016-7191

The Microsoft Azure Active Directory Passport aka Passport-Azure-AD library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token...

PT-2016-7261

Name of the Vulnerable Software and Affected Versions passport-azure-ad versions 1.x through 1.4.5 passport-azure-ad versions 2.x through 2.0.0 Description The issue allows remote attackers to bypass authentication via a crafted token because the validateIssuer setting is not recognized...