387 matches found
aad-sso-enum-brute-spray
aad-sso-enum-brute-spray SecureWorks 近期披露的 Azure Active Directory 密码暴力破解漏洞的概念验证（POC） 描述 此代码是最近披露的 Azure Active Directory 密码暴力破解漏洞的概念验证，该漏洞由 Secureworks 公布（Ars Technica 的这篇文章 比官方发布大约早一天，但内容几乎完全相同）。 理论上，这种方法允许攻击者对一个或多个 AAD 账户执行暴力破解或密码喷洒攻击，而不会引发账户锁定或产生日志数据，从而使攻击难以被察觉。 用法 基本用法很简单： 密码喷洒 root@kitploit:...
CVE-2025-53786
CVE-2025-53786 Exploit This project provides a proof-of-concept PoC exploit targeting a critical vulnerability in Microsoft Exchange Server hybrid deployments, identified as CVE-2025-53786. This vulnerability allows an attacker with administrative access to an on-premises Exchange server to...
caOptics
注意 项目已归档，原因是开发优先级发生变化，且我将社区工作重心转移到其他领域（PoC、其他工具和演示/展示），因此该项目已设为只读。 CA Optics - Azure AD 条件访问差距分析器 什么是条件访问？ 给早期测试者的说明 发布说明 文档 差距示例 排列生成 先决条件 重要事项 描述 - 条件访问差距分析器 与现有工具的比较 范围 偏好性设计 设计决策 平台查找 查找差异 组嵌套 参数 从 launch.json 提供参数（在 VSCode 中调试）？ 运行工具 查看报告 故障排除 贡献 CA Optics - Azure AD 条件访问差距分析器 Azure AD...
Azure-AccessPermissions
Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
EUVD-2026-63692
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69851
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69851
An SSRF vulnerability in Microsoft Entra ID (Azure Active Directory) allows an authorized attacker to elevate privileges over a network. CVSS 9.9 (critical) reflects network access, low complexity, and full confidentiality/integrity/availability impact. Exploitation status and patch details are n...
Microsoft Entra ID Elevation of Privilege Vulnerability
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
PT-2026-79215
Name of the Vulnerable Software and Affected Versions Azure Active Directory affected versions not specified Description Server-side request forgery SSRF, a flaw where an attacker induces a server-side application to make requests to an unintended location, exists in Azure Active Directory. This...
EUVD-2026-54315
Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-50481
Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-50481
Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
...
CVE-2026-50481
CVE-2026-50481 affects Azure Active Directory, where modification of assumed-immutable data (maid) enables an authorized attacker to elevate privileges over a network. The CVSS data indicates NETWORK attack vector, LOW access complexity, LOW privileges required, and HIGH confidentiality/integrity...
CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
...
KLA91190 Multiple vulnerabilities in Microsoft Azure
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...
CVE-2026-59243
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
EUVD-2026-50216
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...