438 matches found
monkey365
Monkey365 is an open-source security assessment framework for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals, consultants, administrators, and incident responders identify misconfigurations, review cloud security posture, and evaluate environments against industry...
CVE-2025-53786
CVE-2025-53786 Exploit This project provides a proof-of-concept PoC exploit targeting a critical vulnerability in Microsoft Exchange Server hybrid deployments, identified as CVE-2025-53786. This vulnerability allows an attacker with administrative access to an on-premises Exchange server to...
aad-sso-enum-brute-spray
aad-sso-enum-brute-spray POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln Description This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks here is the Ars Technica article that...
caOptics
Note Project archived due to shifting development priorities and refocusing my community efforts to other areas PoCs, other tools and demos/presentation, project is set to read-only. CA Optics - Azure AD Conditional Access Gap Analyzer What is Conditional Access? Notes for early testers Release...
Azure-AccessPermissions
Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...
CVE-2026-85916
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
CVE-2026-85916
A vulnerability in Azure Active Directory allows an unauthorized attacker to perform a local disclosure of private personal information. The vulnerability is categorized under CWE-359 , which involves the exposure of private personal information to an unauthorized actor. The CVSS 3.1 score is 6.2...
Azure Active Directory Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-85916: Azure Active Directory Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally...
CVE-2026-83711 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
...
CVE-2026-83711: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
Microsoft Entra ID Deserialization Code Execution
The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to deficiencies in deserialization mechanisms. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
EUVD-2026-63692
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69851
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69851
An SSRF vulnerability in Microsoft Entra ID (Azure Active Directory) allows an authorized attacker to elevate privileges over a network. CVSS 9.9 (critical) reflects network access, low complexity, and full confidentiality/integrity/availability impact. Exploitation status and patch details are n...
Microsoft Entra ID Elevation of Privilege Vulnerability
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
PT-2026-79215
Name of the Vulnerable Software and Affected Versions Azure Active Directory affected versions not specified Description Server-side request forgery SSRF, a flaw where an attacker induces a server-side application to make requests to an unintended location, exists in Azure Active Directory. This...
CVE-2026-69851: Server-Side Request Forgery (SSRF)
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...