Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network. CVSSv3.1 8.6 (HIGH)
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 10.0 (CRITICAL)
Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network. CVSSv3.1 8.5 (HIGH)
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. CVSSv3.1 8.6 (HIGH)
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network. CVSSv3.1 8.5 (HIGH)
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 9.6 (CRITICAL)
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. CVSSv3.1 9.9 (CRITICAL)
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. CVSSv3.1 9.9 (CRITICAL)
Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. CVSSv3.1 8.6 (HIGH)
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. CVSSv3.1 9.1 (CRITICAL)
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 10.0 (CRITICAL)
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 10.0 (CRITICAL)
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. CVSSv3.1 10.0 (CRITICAL)
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. CVSSv3.1 9.9 (CRITICAL)
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 9.3 (CRITICAL)
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg CVSSv3.1 8.5 (HIGH)
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23. CVSSv3.1 8.5 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root. CVSSv3.1 8.8 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel. CVSSv3.1 8.2 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. CVSSv3.1 8.1 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to an out-of-bounds write. CVSSv3.1 8.4 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer. CVSSv3.1 8.2 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. CVSSv3.1 9.9 (CRITICAL)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. CVSSv3.1 8.8 (HIGH)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. CVSSv3.1 8.4 (HIGH)