Known vulnerabilities in Azure DevOps Server

Vendor: Microsoft
Software: Azure DevOps Server
Software CPE: cpe:2.3:a:microsoft:azure_devops_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 39
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Azure DevOps Server Azure DevOps Server is affected by 39 known vulnerabilities: 4 high, 22 medium, 13 low Critical High Medium Low

Vulnerabilities (39)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU122567 - Server-Side Request Forgery (SSRF)
CVE-2026-21512		 CWE-918 Medium
No
No
 - 10.02.2026 SB2026021077
#VU94040 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-35267		 CWE-79 Low
No
No
 - 10.07.2024 SB2024071001
#VU94039 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-35266		 CWE-79 Low
No
No
 - 10.07.2024 SB2024071001
#VU86422 - Improper input validation
CVE-2024-20667		 CWE-20 Medium
No
No
 - 13.02.2024 SB2024021350
#VU84422 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2023-21751		 CWE-451 Medium
No
No
 - 14.12.2023 SB20231213106
#VU81851 - Permissions, Privileges, and Access Controls
CVE-2023-36561		 CWE-264 Medium
No
No
 20230926.1, 20230926.2, 20230927.1 11.10.2023 SB2023101112
#VU80693 - Improper input validation
CVE-2023-33136		 CWE-20 Medium
No
No
 20230601.3, 20230820.2, 20230823.1, 20230825.1, 20230825.4 12.09.2023 SB2023091264
#VU80692 - Deserialization of Untrusted Data
CVE-2023-38155		 CWE-502 Low
No
No
 20230601.3, 20230820.2, 20230823.1, 20230825.1, 20230825.4 12.09.2023 SB2023091264
#VU79254 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2023-36869		 CWE-451 Medium
No
No
 - 08.08.2023 SB20230808122
#VU77245 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2023-21565		 CWE-451 Medium
No
No
 - 13.06.2023 SB2023061359
#VU77244 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2023-21569		 CWE-451 Medium
No
No
 - 13.06.2023 SB2023061359
#VU72232 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-21564		 CWE-79 Medium
No
No
 2022 Patch 2 15.02.2023 SB2023021515
#VU72231 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-21553		 CWE-94 Medium
No
No
 2020 Update 1.2 Patch 5 15.02.2023 SB2023021514
#VU52067 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2021-28459		 CWE-451 Medium
No
No
 - 13.04.2021 SB2021041308
#VU52066 - Exposure of sensitive information to an unauthorized actor
CVE-2021-27067		 CWE-200 Medium
No
No
 - 13.04.2021 SB2021041307
#VU48872 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2020-17135		 CWE-451 Medium
No
No
 - 08.12.2020 SB2020120833
#VU48861 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2020-17145		 CWE-451 Medium
No
No
 - 08.12.2020 SB2020120825
#VU48319 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2020-1325		 CWE-451 Medium
No
No
 - 10.11.2020 SB2020111055
#VU29841 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-1326		 CWE-79 Low
No
No
 - 14.07.2020 SB2020071467
#VU28919 - Improper Control of Generation of Code ('Code Injection')
CVE-2020-1327		 CWE-94 Low
No
No
 - 10.06.2020 SB2020061005


Showing elements 1 - 20 out of 39