Microsoft Team Foundation Server vulnerabilities

23 CVEs affecting Microsoft Team Foundation Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-27067, published 2021-04-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1306, published 2019-09-11. Critical severity, CVSS 9.8. EPSS: 17% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code…
CVE-2018-8529, published 2018-11-15. Critical severity, CVSS 9.8. EPSS: 13.5% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Search services, aka "Team Foundation…
CVE-2019-1072, published 2019-07-15. Critical severity, CVSS 9.8. EPSS: 13.4% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code…
CVE-2019-0971, published 2019-05-16. Medium severity, CVSS 6.5. EPSS: 8.5% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server,…
CVE-2019-0647, published 2019-01-17. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This…
CVE-2021-27067, published 2021-04-13. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
CVE-2019-0866, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…
CVE-2019-0871, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…
CVE-2019-0870, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…
CVE-2019-0868, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…

Latest

CVE-2020-17145, published 2020-12-10. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
CVE-2020-0758, published 2020-03-12. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps Server and Team Foundation Services…
CVE-2020-0700, published 2020-03-12. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.
CVE-2019-1305, published 2019-09-11. Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
CVE-2019-1076, published 2019-07-15. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
CVE-2019-0979, published 2019-05-16. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server…