Check-AAD-Connect-for-CVE-2021-36949-vulnerability

El script comprobará si tu Azure AD Connect está ejecutando una versión afectada por la vulnerabilidad descrita en CVE-2021-36949. Las versiones afectadas son 1.6.4.0 y 2.0.3.0. Ejecuta el script en el servidor que aloja la instalación de AAD Connect. El script también comprueba si la función de...

Azure API Center Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network...

Azure Event Grid Spoofing Vulnerability

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

Azure App Service Remote Code Execution Vulnerability

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network...

Azure SRE Agent Elevation of Privilege Vulnerability

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

USN-8904-1: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

Thunderstorm

Thunderstorm No tienes 4.000 hallazgos. Tienes seis caminos hacia tus joyas de la corona. Un CSPM te entrega una lista plana, deduplicada y ordenada por severidad de configuraciones erróneas y te deja adivinar cuáles importan. Thunderstorm razona sobre la alcanzabilidad : recopila tu nube en modo...

azure-vulnerability-remediation-project

Investigación y Remediación de Vulnerabilidades: Infraestructura en la Nube Azure Resumen del Proyecto Este proyecto documenta el ciclo de vida completo de gestión de vulnerabilidades para una instancia de Windows Server 2025 alojada en la nube CyberVM. El laboratorio demuestra un enfoque proacti...

PT-2026-108296

Name of the Vulnerable Software and Affected Versions Microsoft Azure SRE Agent affected versions not specified Description A missing authorization flaw in the Microsoft Azure SRE Agent allows an authenticated, low-privileged attacker to elevate privileges over a network. This issue could...

PT-2026-108297

Name of the Vulnerable Software and Affected Versions Azure App Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized, network-reachable attacker to execute arbitrary code without providing credentials. Recommendations At the...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

EUVD-2026-94013

Backstage: Cloud storage catalog locations may cross configured storage boundaries...

Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...

GHSA-XVH9-35W9-42M4 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...

CVE-2026-106493

A flaw was found in Backstage. Cloud storage catalog providers do not sufficiently validate object paths. An attacker with permissions to create or rename objects in a configured cloud storage source, such as Amazon Web Services AWS S3 or Azure Blob Storage, can cause catalog descriptors to be re...

The vulnerability of Azure CycleCloud, a tool for organizing and managing high-performance computing environments, related to insufficient protection of registration data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure CycleCloud tool for organizing and managing high-performance computing environments is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106490

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...