CVE-2025-65037

CVE-2025-65037 affects Azure Container Apps. The root cause is improper control of code generation, enabling an attacker to perform remote code execution over the network via a code-injection vulnerability in the container platform. Impact is described as arbitrary code execution with high confid...

EUVD-2025-204299

In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored a...

CVE-2025-14823 Certificate Signing Extension Returns Encrypted Values

In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored a...

CVE-2025-14823

The CVE-2025-14823 issue affects ConnectWise ScreenConnect’s Certificate Signing Extension. Affected: Certificate Signing Extension prior to version 1.0.12. Description across sources shows that encrypted configuration values, including an Azure Key Vault-related key, could be exposed in client r...

Azure Cosmos DB Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network...

Azure Container Apps Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in Azure Container Apps allows an unauthorized attacker to execute code over a network...

Microsoft Azure Cosmos DB 跨站脚本漏洞

Microsoft Azure Cosmos DB is a distributed multi-model database from Microsoft USA. A spoofing vulnerability exists in Microsoft Azure Cosmos DB that stems from improper input neutralization and can be exploited by an attacker to cause a network spoofing attack...

Ubuntu: Security Advisory (USN-7939-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-52360

Name of the Vulnerable Software and Affected Versions Azure Container Apps affected versions not specified Description An improper control of generation of code issue, also known as 'code injection', exists in Azure Container Apps. This allows an unauthorized attacker to execute code over a...

December 18, 2025—KB5074980 (Monthly Rollup) Out-of-band

None None...

Ubuntu: Security Advisory (USN-7939-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-52373

Name of the Vulnerable Software and Affected Versions Azure Cosmos DB affected versions not specified Description An issue exists in Azure Cosmos DB related to improper neutralization of input during web page generation, leading to a cross-site scripting condition. This allows an unauthorized...

Microsoft Azure Cognitive Service for Language 代码问题漏洞

Microsoft Azure Cognitive Service for Language is a cloud-based natural language processing service from Microsoft USA. An elevation of privilege vulnerability exists in Microsoft Azure Cognitive Service for Language, which is caused by a flaw in a customized question and answer. An attacker coul...

Microsoft Azure Container Apps 代码注入漏洞

Microsoft Azure Container Apps is a serverless container platform from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Azure Container Apps that stems from improper code generation controls and could lead to an unauthorized attacker executing code over the network...

December 18, 2025—KB5074978 (Monthly Rollup) Out-of-band

None None...

Malicious Package

Overview ms-azuretools.vscode-azureresourcegroups is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

EUVD-2025-203811

Malicious code in vscode-azure-mcp-server npm...

Malicious code in vscode-azure-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee81b2442f4cf9659439b86f4d75212f59a5471403e97b4720448df2997d1561 The package vscode-azure-mcp-server was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192601 Malicious code in vscode-azure-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee81b2442f4cf9659439b86f4d75212f59a5471403e97b4720448df2997d1561 The package vscode-azure-mcp-server was found to contain malicious code. Source: ghsa-malware...

USN-7937-1: Linux kernel (Azure FIPS) vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...