Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges or execute arbitrary code with the privileges of the vulnerable application. Azure PromptFlow:...

CVE-2025-21199

Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-21199

Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-21199 Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability

...

CVE-2025-21199 Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability

...

CVE-2025-21199

Azure Agent Installer for Backup and Site Recovery is affected by CVE-2025-21199 due to improper privilege management, allowing an authorized attacker to elevate privileges locally. The issue targets the Azure Agent Installer component used for disaster recovery, with a CVSSv3.1 base score of 6.7...

Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability

Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally...

Log Injection

Envoy Gateway is vulnerable to Log Injection. The vulnerability is due to improper log handling due to the use of a default Envoy Proxy access log configuration, allowing attackers to craft user-agent strings that inject and overwrite fields in the access log...

PT-2025-10796

Name of the Vulnerable Software and Affected Versions Azure Agent Installer affected versions not specified Description The issue is related to improper privilege management in the Azure Agent Installer, which allows an authorized attacker to elevate privileges locally. Recommendations At the...

A Practical Memory Injection Attack against LLM Agents

In this whitepaper, the authors propose a novel Memory INJection Attack, MINJA, that enables the injection of malicious records into the memory bank by only interacting with the agent via queries and output observations...

OPENSUSE-SU-2025:14870-1 google-osconfig-agent-20250115.01-3.1 on GA media

These are all security issues fixed in the google-osconfig-agent-20250115.01-3.1 package on the GA media of openSUSE Tumbleweed...

Microsoft Azure 安全漏洞

Microsoft Azure Agent Installer for Backup and Site Recovery provides disaster recovery solutions for local computers and Azure VMs. An elevation of privilege vulnerability exists in Microsoft Azure Agent Installer for Backup and Site Recovery, which can be exploited by an attacker to elevate...

OPENSUSE-SU-2025:14869-1 google-guest-agent-20250116.00-3.1 on GA media

These are all security issues fixed in the google-guest-agent-20250116.00-3.1 package on the GA media of openSUSE Tumbleweed...

Amazon Linux 2 : aws-kinesis-agent (ALAS-2025-2788)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2788 advisory. In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2779)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300052.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2779 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause ...

CVE-2025-24864

Incorrect access permission of a specific folder issue exists in RemoteView Agent for Windows versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege...

CVE-2025-22447

Incorrect access permission of a specific service issue exists in RemoteView Agent for Windows versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege...

CVE-2025-2065

A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. This affects an unknown part of the file /editAgent.php. The manipulation of the argument agentid leads to sql injection. It is possible to initiate the attack remotely. The exploit...

Projectworlds Life Insurance Management System 注入漏洞

Projectworlds Life Insurance Management System is a life insurance management system from Projectworlds India. An injection vulnerability exists in Projectworlds Life Insurance Management System version 1.0, which stems from improper manipulation of the agentid parameter and can lead to SQL...

Amazon Linux 2023 : aws-kinesis-agent (ALAS2023-2025-889)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-889 advisory. In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is...