13437 matches found
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the AesCbcHmacSha2Decryptor.doFinal function, which effectively skips authentication by comparing the computed authentication tag with itself rather than with the received tag, for A128CBC-HS256, A192CBC-HS384...
com.azure.resourcemanager:azure-resourcemanager (>=2.52.0 <=2.60.0), com.azure.resourcemanager:azure-resourcemanager-appservice (>=2.52.0 <=2.55.0) +20 more potentially affected by CVE-2026-33117 via com.azure:azure-security-keyvault-keys (>=4.10.0 <=4.10.5)
com.azure:azure-security-keyvault-keys MAVEN version =4.10.0, =2.52.0, =2.52.0, =2.52.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =3.2.0, =239.v0e088b133a77, =0.17.0, =0.17.0, =5.13.0, =1.2.0, =4.19.0, =4.20.0 and more Source cves: CVE-2026-33117htt...
EUVD-2026-29708
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...
EUVD-2026-29710
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...
EUVD-2026-29657
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...
EUVD-2026-29655
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network...
com.azure.resourcemanager:azure-resourcemanager (>=2.52.0 <=2.60.0), com.azure.resourcemanager:azure-resourcemanager-appservice (>=2.52.0 <=2.55.0) +20 more potentially affected by CVE-2026-33117 via com.azure:azure-security-keyvault-keys (>=4.10.0 <=4.10.5)
com.azure:azure-security-keyvault-keys MAVEN version =4.10.0, =2.52.0, =2.52.0, =2.52.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =3.2.0, =239.v0e088b133a77, =0.17.0, =0.17.0, =5.13.0, =1.2.0, =4.19.0, =4.20.0 and more Source cves: CVE-2026-33117htt...
EUVD-2026-29578
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network...
GHSA-97JF-46M3-8953 Security feature bypass vulnerability in Azure Key Vault Keys library for Java
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...
EUVD-2026-29580
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-29574
External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...
Security feature bypass vulnerability in Azure Key Vault Keys library for Java
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...
CVE-2026-42830
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...
CVE-2026-42823
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-40379
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-40381
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...
CVE-2026-33833
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-33117
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...
CVE-2026-33117
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...