Azure Linux 3.0 Security Update: kernel (CVE-2025-21796)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21796 advisory. - In the Linux kernel, the following vulnerability has been resolved: nfsd: clear aclaccess/acldefault after...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21920)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21920 advisory. - In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type...

Azure Linux 3.0 Security Update: libtiff (CVE-2023-6228)

The version of libtiff installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-6228 advisory. - An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21912)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21912 advisory. - In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use rawspinlock to protect...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21905)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21905 advisory. - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21680)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21680 advisory. - In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21904)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21904 advisory. - In the Linux kernel, the following vulnerability has been resolved: caifvirtio: fix wrong pointer check in...

CVE-2025-3879

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when operator-imposed boundlocations restrictions are in effect, due to missing validation of Azure-issued JWTs against vmname or vmssname values. A user can bypass the intended geographic restrictions by...

GHSA-F9CH-H8J7-8JWG Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-21416

Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network...

CVE-2025-30392

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-30390

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network...

CVE-2025-30389

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-33074

Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network...

CVE-2025-3879

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879 Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879

CVE-2025-3879 affects Vault (Vault Community and Vault Enterprise) where the Azure Auth method did not correctly validate claims in the Azure-issued token, allowing potential bypass of the bound_locations restriction on login. The issue is described across multiple sources and is evidenced by OSV...

CVE-2025-3879 Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...