ROS-20250630-07

A vulnerability in HashiCorp's Vault and Vault Enterprise enterprise information archiving platforms was related to incorrect validation of an assertion in an Azure-issued token, leading to a potential circumvention of the boundlocations parameter at login. Exploitation of the vulnerability could...

CVE-2025-53013

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

CVE-2025-53013

Summary (CVE-2025-53013, Himmelblau) : Versions 0.9.10–0.9.16 allow offline authentication to a Linux host via Himmelblau using an invalid Linux Hello PIN. The root cause is an incorrect handling in acquire_token_by_hello_for_business_key: offline, a TPMFail is expected for an invalid key, but a ...

CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

Building security that lasts: Microsoft’s journey towards durability at scale ​​

In this blog you will hear directly from Microsoft’s Deputy Chief Information Security Officer CISO for Azure and operating systems, Mark Russinovich, about how Microsoft operationalized security durability at scale. This blog is part of an ongoing series where our Deputy CISOs share their though...

Himmelblau 授权问题漏洞

Himmelblau is an Azure Entra ID authentication module open-sourced by Himmelblau. An authorization issue vulnerability exists in Himmelblau versions 0.9.10 to 0.9.16, which stems from an invalid Linux Hello PIN authentication that can be used while offline...

Azure Linux 3.0 Security Update: mysql (CVE-2025-30699)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30699 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported...

Azure Linux 3.0 Security Update: mysql (CVE-2025-21577)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21577 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are...

Azure Linux 3.0 Security Update: mysql (CVE-2025-30703)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30703 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are...

Azure Linux 3.0 Security Update: mysql (CVE-2024-20981)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20981 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are...

Azure Linux 3.0 Security Update: mysql (CVE-2025-30705)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30705 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PS. Supported versions that are...

Azure Linux 3.0 Security Update: mysql (CVE-2024-20961)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20961 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions th...

Microsoft Azure Machine Learning Environments Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within Azure Machine Learning Environments. The issue results from predictable...

Azure Linux 3.0 Security Update: mysql (CVE-2024-20963)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20963 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported...

Azure Linux 3.0 Security Update: mysql (CVE-2025-21584)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21584 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are...

Azure Linux 3.0 Security Update: mysql (CVE-2024-20969)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20969 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are...

Azure Linux 3.0 Security Update: mysql (CVE-2025-21581)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21581 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions th...

Azure Linux 3.0 Security Update: mysql (CVE-2025-21574)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21574 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that...

Azure Linux 3.0 Security Update: mysql (CVE-2025-30685)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30685 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions...