Search vulnerabilities

Expected end of text, found ':' (at char 35), (line:1, col:36)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2021-41372

Power BI Report Server Spoofing Vulnerability

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Power Bi Report Server
CVE-2021-42306

Azure Active Directory Information Disclosure Vulnerability

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential  on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.

CVSS 3.1 · 8.1 High EPSS 3.3% KEV · Not listed
Vendors
Microsoft
Products
Azure Active Directory Azure Active Site Recovery Azure Automation and 1 more
CVE-2021-42286

Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability

Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 Windows 10 1809 Windows 10 20h2 and 5 more
CVE-2021-41376

Azure Sphere Information Disclosure Vulnerability

Azure Sphere Information Disclosure Vulnerability

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Sphere
CVE-2021-41375

Azure Sphere Information Disclosure Vulnerability

Azure Sphere Information Disclosure Vulnerability

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Sphere
CVE-2021-41374

Azure Sphere Information Disclosure Vulnerability

Azure Sphere Information Disclosure Vulnerability

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Sphere