Technology
Public cloud services and their SDKs/agents (AWS, Azure, Google Cloud). 1,051 published CVES affecting Cloud Platforms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first · page 1 of 40 · showing the latest 1,000
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-...
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles a...
Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain....
Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue t...
Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.
Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.
Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.
Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.
Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.
Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.
Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.