Michal Kamensky

Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.

Improper input validation allows an authorized attacker to disclose information over a network.

Unrestricted upload of files with dangerous types allows an unauthorized attacker to execute code over a network. This issue enables unauthenticated Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a target machine from a remote location.

An improper authentication issue exists in Azure Arc that could allow an authorized attacker to elevate privileges locally. Microsoft has disclosed three elevation of privilege flaws in Azure Virtual Machines, potentially granting authorized users local administrator access on Arc-enabled Windows and Linux VMs.

The software contains a flaw in how it generates code, potentially allowing an attacker on the same network to run code without authorization. There is no information about the number of potentially affected devices or any real-world incidents where this issue was exploited. The issue involves improper control of code generation, also known as 'code injection'.

A flaw in the certificate validation process within Azure Local can allow a remote attacker to execute code. This issue involves errors in the authentication procedure for certificates.

Name of the Vulnerable Software and Affected Versions: Azure File Sync (affected versions not specified) Description: Improper access control in Azure File Sync can allow an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent (affected versions not specified) Description: The issue is related to improper control of generation of code, also known as 'code injection', in Azure Monitor Agent. This allows an unauthorized attacker to execute code over an adjacent network. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.