Michal Kamensky

**Name of the Vulnerable Software and Affected Versions** Azure Compute Gallery (affected versions not specified) **Description** Improper input validation allows an authorized attacker to disclose information over a network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Orbital Spatio (affected versions not specified) **Description** Unrestricted upload of files with dangerous types allows an unauthorized attacker to execute code over a network. This issue enables unauthenticated Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a target machine from a remote location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Arc (affected versions not specified) **Description** An improper authentication issue exists in Azure Arc that could allow an authorized attacker to elevate privileges locally. Microsoft has disclosed three elevation of privilege flaws in Azure Virtual Machines, potentially granting authorized users local administrator access on Arc-enabled Windows and Linux VMs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Defender for Linux (affected versions not specified) **Description** The software contains a flaw in how it generates code, potentially allowing an attacker on the same network to run code without authorization. There is no information about the number of potentially affected devices or any real-world incidents where this issue was exploited. The issue involves improper control of code generation, also known as 'code injection'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Local (affected versions not specified) **Description** A flaw in the certificate validation process within Azure Local can allow a remote attacker to execute code. This issue involves errors in the authentication procedure for certificates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Azure File Sync (affected versions not specified) Description: Improper access control in Azure File Sync can allow an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent (affected versions not specified) Description: The issue is related to improper control of generation of code, also known as 'code injection', in Azure Monitor Agent. This allows an unauthorized attacker to execute code over an adjacent network. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.