ObfuscatedSharpCollection

Obfuscated SharpCollection Intento rápido y sucio de ofuscación automatizada utilizando yetAnotherObfuscator por @0xcc00 junto con compilaciones recientes de herramientas ofensivas comunes en C, de forma CDI mediante canalizaciones de lanzamiento de Azure DevOps. Obfuscated SharpCollection no...

nord-stream

Nord Stream Nord Stream es una herramienta que permite extraer secretos almacenados en entornos CI/CD mediante el despliegue de pipelines maliciosos. Actualmente es compatible con Azure DevOps, GitHub y GitLab. Puedes encontrar más información en el siguiente artículo de blog:...

ADOKit

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit es un conjunto de herramientas que se puede utilizar para atacar servicios de Azure DevOps aprovechando la API REST disponible. La herramienta permite al usuario especificar un módulo de ataque, junto con credenciales válidas clave...

POC-CVE-2026-42826-2026-42826-Microsoft-Azure-DevOps-Information-Disclosure-Vulnerability

CVE-2026-42826 — PoC de divulgación de información de Azure DevOps Resumen...

SharpCollection

SharpCollection Compilaciones nocturnas de herramientas ofensivas comunes en C, recién salidas de sus respectivas ramas master, compiladas y publicadas de forma CDI mediante canalizaciones de lanzamiento de Azure DevOps. ¿Falta tu herramienta favorita? No dudes en abrir un issue o enviarme un...

sysmon-parser

sysmon-parser Parser de Sysmon generado automáticamente para Azure Sentinel Sysmon-AllVersionsParser.txt se puede cargar como una función en Azure Sentinel para analizar todos tus eventos. Existe una canalización de Azure Devops que se activa a diario para instalar la última versión de Sysmon,...

azuredevops-enum

ado-enum Una herramienta de línea de comandos para enumerar organizaciones de Azure DevOps mediante un token de acceso personal PAT. Consulta la API REST de Azure DevOps para exponer proyectos, repositorios, conexiones de servicio, compilaciones, artefactos de compilación y ajustes de seguridad,...

CVE-2020-37267

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. An attacker with access to these logs could obtain the bot's...

CVE-2020-37267

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

EUVD-2020-31261

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2020-37267

Renovate versions >=19.180.0 and

CVE-2020-37267 Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2026-66378

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

Malicious code in matlab-azure-devops-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b The package's preinstall script node index.js auto-executes on npm install and collects host identifiers os.hostname, os.userInfo.username, home...

Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one ...

vulnerabilities handled in Microsoft Developer Tools

Microsoft has addressed vulnerabilities in various Developer Tools. A malicious individual could exploit these vulnerabilities to carry out attacks that can cause the following types of damage: - Denial-of-Service DoS attacks - Bypass of security measures - Execution of arbitrary code user rights...

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

EUVD-2026-28460

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

The vulnerability of the Azure DevOps software development tool, related to information disclosure, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure DevOps software development tool is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...