Azure Devops Server (Microsoft) - vulnerabilities (CVEs)

40 CVEs, 0 in the last 30 days, 43 known versions, newest CVE from 2026-02-10. Vendor: Microsoft.

CVEs of Azure Devops Server

CVE-2026-21512 - CVSS 6.5 (medium), 2026-02-10: Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.
CVE-2024-35266 - CVSS 7.6 (high), 2024-07-09: Azure DevOps Server Spoofing Vulnerability
CVE-2024-35267 - CVSS 7.6 (high), 2024-07-09: Azure DevOps Server Spoofing Vulnerability
CVE-2024-20667 - CVSS 7.5 (high), 2024-02-13: Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-21751 - CVSS 6.5 (medium), 2023-12-14: Azure DevOps Server Spoofing Vulnerability
CVE-2023-36561 - CVSS 7.3 (high), 2023-10-10: Azure DevOps Server Elevation of Privilege Vulnerability
CVE-2023-38155 - CVSS 8.1 (high), 2023-09-12: Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-33136 - CVSS 8.8 (high), 2023-09-12: Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-36869 - CVSS 6.3 (medium), 2023-08-08: Azure DevOps Server Spoofing Vulnerability
CVE-2023-21569 - CVSS 5.5 (medium), 2023-06-14: Azure DevOps Server Spoofing Vulnerability
CVE-2023-21565 - CVSS 7.1 (high), 2023-06-14: Azure DevOps Server Spoofing Vulnerability
CVE-2023-21553 - CVSS 7.5 (high), 2023-02-14: Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-21564 - CVSS 7.1 (high), 2023-02-14: Azure DevOps Server Cross-Site Scripting Vulnerability
CVE-2021-28459 - CVSS 6.1 (medium), 2021-04-13: Azure DevOps Server Spoofing Vulnerability
CVE-2021-27067 - CVSS 6.5 (medium), 2021-04-13: Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
CVE-2020-17145 - CVSS 5.4 (medium), 2020-12-10: Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
CVE-2020-17135 - CVSS 6.4 (medium), 2020-12-10: Azure DevOps Server Spoofing Vulnerability
CVE-2020-1325 - CVSS 5.4 (medium), 2020-11-11: Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
CVE-2020-1326 - CVSS 5.4 (medium), 2020-07-14: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site…
CVE-2020-1327 - CVSS 6.1 (medium), 2020-06-09: A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection…
CVE-2020-0815 - CVSS 7.5 (high), 2020-03-12: An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps…
CVE-2020-0758 - CVSS 7.5 (high), 2020-03-12: An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps…
CVE-2020-0700 - CVSS 5.4 (medium), 2020-03-12: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site…
CVE-2019-1306 - CVSS 9.8 (critical), 2019-09-11: A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure…
CVE-2019-1305 - CVSS 5.4 (medium), 2019-09-11: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server…
CVE-2019-1072 - CVSS 9.8 (critical), 2019-07-15: A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server…
CVE-2019-1076 - CVSS 5.4 (medium), 2019-07-15: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server…
CVE-2019-0996 - CVSS 6.5 (medium), 2019-06-12: A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request…
CVE-2019-0979 - CVSS 5.4 (medium), 2019-05-16: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…
CVE-2019-0971 - CVSS 6.5 (medium), 2019-05-16: An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted…
CVE-2019-0872 - CVSS 5.4 (medium), 2019-05-16: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…
CVE-2019-0875 - CVSS 7.5 (high), 2019-04-09: An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation…
CVE-2019-0874 - CVSS 6.1 (medium), 2019-04-09: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site…
CVE-2019-0867 - CVSS 6.1 (medium), 2019-04-09: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…
CVE-2019-0870 - CVSS 6.1 (medium), 2019-04-09: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…
CVE-2019-0866 - CVSS 6.1 (medium), 2019-04-09: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…
CVE-2019-0869 - CVSS 6.1 (medium), 2019-04-09: A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection…
CVE-2019-0857 - CVSS 6.5 (medium), 2019-04-09: A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka…
CVE-2019-0868 - CVSS 6.1 (medium), 2019-04-09: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…
CVE-2019-0871 - CVSS 6.1 (medium), 2019-04-09: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure…