CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

The CVE concerns Jenkins Azure AD Plugin versions 396.v86ce29279947 and earlier (except 378.380.v545b_1154b_3fb_) using a non-constant time nonce comparison for CSRF protection, enabling statistical analysis to potentially obtain a valid nonce. This is the root cause: a non-constant time comparis...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

Ubuntu 20.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-6347-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6347-1 advisory. William Zhao discovered that the Traffic Control TC subsystem in the Linux kernel did not properly handle network packet retransmission in certain...

Jenkins Plugin Azure AD Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Ubuntu 23.04 : Linux kernel (Azure) vulnerabilities (USN-6344-1)

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6344-1 advisory. Zi Fan Tan discovered that the binder IPC implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cau...

FileMage Gateway 1.10.9 Local File Inclusion

Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion Date: 8/22/2023 Exploit Author: Bryce "Raindayzz" Harty Vendor Homepage: https://www.filemage.io/ Version: Azure Versions 1.10.9 Tested on: All Azure deployments 1.10.9 CVE : CVE-2023-39026 Technical Blog -...

FileMage Gateway 1.10.9 - Local File Inclusion Exploit

Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion Exploit Author: Bryce "Raindayzz" Harty Vendor Homepage: https://www.filemage.io/ Version: Azure Versions 1.10.9 Tested on: All Azure deployments 1.10.9 CVE : CVE-2023-39026 Technical Blog -...

FileMage Gateway 1.10.9 - Local File Inclusion

Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion Date: 8/22/2023 Exploit Author: Bryce "Raindayzz" Harty Vendor Homepage: https://www.filemage.io/ Version: Azure Versions 1.10.9 Tested on: All Azure deployments 1.10.9 CVE : CVE-2023-39026 Technical Blog -...

Cannot complete your request error when using Azure AD saml authentication

SAML authentication policy for AG has been configured. The IDP is Azure AD. However, "Can not complete your request error" appeared when using AG SSO Storefront...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6332-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6332-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various...

Ubuntu: Security Advisory (USN-6332-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6332-1: Linux kernel (Azure) vulnerabilities

Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. CVE-2022-40982 William Zhao discovered that the Traffic Control T...

Security Bulletin: A vulnerability in Microsoft Azure SDK for .NET affects IBM Robotic Process Automation and could allow a remote authenticated attacker to obtain sensitive information (CVE-2022-26907).

Summary Microsoft Azure SDK for .NET is used in the development of IBM Robotic Process Automation CVE-2022-26907. Vulnerability Details CVEID:CVE-2022-26907 DESCRIPTION: Microsoft Azure SDK for .NET could allow a remote authenticated attacker to obtain sensitive information. By sending a...

Citrix MCS failed when Azure storage account configured with TLS 1.2 Version.

Citrix MCS fails if the Azure storage account is configured with the TLS 1.2 version...

"Cannot complete your request." After Azure AD/SAML Authentication

External access via ADC with Azure AD MFA Authentication and redirected to StoreFront Store Receiver for Website receives "Cannot complete your request." notification. The following Event IDs are displayed in the Log Name: Citrix Delivery ServicesSource: Citrix Domain ServicesDate:Event ID: 1Task...

Experts Uncover How Cybercriminals Could Exploit Microsoft Entra ID for Elevated Privilege

Cybersecurity researchers have discovered a case of privilege escalation associated with a Microsoft Entra ID formerly Azure Active Directory application by taking advantage of an abandoned reply URL. "An attacker could leverage this abandoned URL to redirect authorization codes to themselves,...

Azure Hosting Test connection shows invalid user name / password / Credentials

Unable to create new machine catalog Running the Test Connection fails with error "Invalid Credentials"...

Veeam Backup for Microsoft 365 Updater Fails With: "Error opening installation log file."

Challenge For Veeam Backup for Microsoft 365 deployments from AWS Marketplace or Microsoft Marketplace, when attempting to install discovered updates or when the auto-updater attempts to update Veeam Backup for Microsoft 365, the update process fails with the error: Error opening installation log...