microsoft vulnerabilities, newest first, page 28

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.

Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.

Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.

Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.

Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to execute code over a network.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.

Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.

Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.