Jianyang Song

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation leads to cross-site scripting, which allows an authorized attacker to elevate privileges over a network.

Improper neutralization of special elements in output used by a downstream component in Copilot Chat allows an unauthorized attacker to disclose information over a network. This is an injection issue where the AI sidebar can be used to leak data.

Improper neutralization of special elements in output used by a downstream component allows an unauthorized attacker to perform spoofing over a network. This issue can lead to notebook spoofing, which may result in data leakage or unauthorized modification of data.

Improper neutralization of input during web page generation in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network. This issue is a form of cross-site scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation or encoding.

An issue exists in Azure Cosmos DB related to improper neutralization of input during web page generation, leading to a cross-site scripting condition. This allows an unauthorized attacker to perform spoofing over a network.