Azure Machine Learning に影響がある SSRF 脆弱性 の軽減について
Monday, June 17, 2024
本ブログは、Mitigating SSRF Vulnerabilities Impacting Azure Machine Learning の抄訳版です。最新の情報は原文を参照してください。 概要 2024
MSRC
Mitigating SSRF Vulnerabilities Impacting Azure Machine Learning
Monday, June 17, 2024
Summary On May 9, 2024, Microsoft successfully addressed multiple vulnerabilities within the Azure Machine Learning (AML) service, which were initially discovered by security research firms Wiz and Tenable. These vulnerabilities, which included Server-Side Request Forgeries (SSRF) and a path traversal vulnerability, posed potential risks for information exposure and service disruption via Denial-of-Service (DOS).
New Security Advisory Tab Added to the Microsoft Security Update Guide
Thursday, February 15, 2024
Today, we are adding a new Security Advisory tab to the Security Update Guide to meet our customers’ needs for a unified and authoritative source for the latest public information about Microsoft security updates and issues. We are continuously listening to feedback from users of the Security Update Guide. Our goal is to find new and improved ways to help customers manage security risks and keep their systems protected.
Microsoft Bug Bounty Program Year in Review: $13.8M in Rewards
Monday, August 07, 2023
We are thrilled to share the results of our collaboration with over 345 security researchers from +45 countries around the world in the past 12 months. Together, we have discovered and fixed more than a thousand potential security issues before they impacted our customers. In recognition of this valuable collaboration, we have awarded $13.
マイクロソフトバグ報奨金プログラムの年間レビュー : 1,380万ドルの報酬
Monday, August 07, 2023
本ブログは、Microsoft Bug Bounty Program Year in Review: $13.8M in Rewards の抄訳版です。最新の情報は原文を参照してください。 過
Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD
Wednesday, March 29, 2023
Summary Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications. The misconfiguration allowed external parties read and write access to the impacted applications. Microsoft immediately corrected the misconfiguration and added additional authorization checks to address the issue and confirmed that no unintended access had occurred.
New MSRC Blog Site
Wednesday, February 08, 2023
We are excited to announce the release of the new Microsoft Security Response Center (MSRC) blog site. Please visit msrc.microsoft.com/blog/ starting February 9th, 2023, for all past and future MSRC blog content. In addition to the new URL, we have refreshed the site with a new look and improved site performance, search, categories, and tags to help users easily find content.
A Ride on the Wild Side with Hacking Heavyweight Sick Codes
Tuesday, November 29, 2022
Beverage of Choice: Krating Daeng (Thai Red Bull) Industry Influencer he Admires: Casey John Ellis What did you want to be when you grew up? A physician and nearly did Hobbies (Present & Past): Motorcycling & Australian Football Bucket List: Continuing to discover new software Fun Fact: He currently has 2,000 tabs open
On-Premises Servers Products are Here! Introducing the Applications and On-Premises Servers Bug Bounty Program
Tuesday, April 05, 2022
Microsoft is excited to announce the addition of Exchange on-premises, SharePoint on-premises, and Skype for Business on-premises to the Applications and On-Premises Servers Bounty Program. Through this expanded program, we encourage researchers to discover and report high-impact security vulnerabilities to help protect customers. We offer awards up to $26,000 USD for eligible submissions.
Disclosure of Vulnerability in Azure Automation Managed Identity Tokens
Monday, March 07, 2022
On December 10, 2021, Microsoft mitigated a vulnerability in the Azure Automation service. Azure Automation accounts that used Managed Identitiestokens for authorization and an Azure Sandbox for job runtime and execution were exposed. Microsoft has not detected evidence of misuse of tokens. Microsoft has notified customers with affected Automation accounts. Microsoft recommends following the security best practices herefor the Azure Automation service