CVE-2023-36660

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for a critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots.

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

VeloCloud Orchestrator (VCO) on-prem has a security issue that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user, accessing functionality intended for internal use only and not meant to be remotely accessible.

No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.

No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.

No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.

No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.