deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-63m5-974w-448v
Package: github.com/fleetdm/fleet (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 4.43.5-0[PII_REDACTED]2845-e225ef57912c
Patched in: 4.43.5-0[PII_REDACTED]2845-e225ef57912c

Summary: Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment 

Details:
### Summary

A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.

### Impact

If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-63m5-974w-448v
Package: github.com/fleetdm/fleet (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 4.75.0, < 4.75.2
Patched in: 4.75.2

Summary: Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment 

Details:
### Summary

A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.

### Impact

If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-63m5-974w-448v
Package: github.com/fleetdm/fleet (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 4.76.0, < 4.76.2
Patched in: 4.76.2

Summary: Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment 

Details:
### Summary

A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.

### Impact

If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-63m5-974w-448v
Package: github.com/fleetdm/fleet (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 4.77.0, < 4.77.1
Patched in: 4.77.1

Summary: Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment 

Details:
### Summary

A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.

### Impact

If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-63m5-974w-448v
Package: github.com/fleetdm/fleet (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 4.78.0, < 4.78.3
Patched in: 4.78.3

Summary: Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment 

Details:
### Summary

A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.

### Impact

If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-4r5r-ccr6-q6f6
Package: github.com/fleetdm/fleet/v4 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 4.78.3-0[PII_REDACTED]1730-5c030e32a3a9
Patched in: 4.78.3-0[PII_REDACTED]1730-5c030e32a3a9

Summary: Fleet has an Access Control vulnerability in debug/pprof endpoints

Details:
### Summary

A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.

### Impact

Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. 

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-4r5r-ccr6-q6f6
Package: github.com/fleetdm/fleet (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.75.0, < 4.75.2
Patched in: 4.75.2

Summary: Fleet has an Access Control vulnerability in debug/pprof endpoints

Details:
### Summary

A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.

### Impact

Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. 

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-4r5r-ccr6-q6f6
Package: github.com/fleetdm/fleet (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.76.0, < 4.76.2
Patched in: 4.76.2

Summary: Fleet has an Access Control vulnerability in debug/pprof endpoints

Details:
### Summary

A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.

### Impact

Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. 

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-4r5r-ccr6-q6f6
Package: github.com/fleetdm/fleet (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.77.0, < 4.77.1
Patched in: 4.77.1

Summary: Fleet has an Access Control vulnerability in debug/pprof endpoints

Details:
### Summary

A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.

### Impact

Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. 

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-4r5r-ccr6-q6f6
Package: github.com/fleetdm/fleet (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.78.0, < 4.78.3
Patched in: 4.78.3

Summary: Fleet has an Access Control vulnerability in debug/pprof endpoints

Details:
### Summary

A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.

### Impact

Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.

### Patches

- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. 

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-gfpw-jgvr-cw4j
Package: github.com/fleetdm/fleet/v4 (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.43.5-0[PII_REDACTED]0427-0e6c790803d1
Patched in: 4.43.5-0[PII_REDACTED]0427-0e6c790803d1

Summary: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Details:
### Summary

A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices.

### Impact

If Windows MDM is enabled, an attacker could exploit a cross-site scripting (XSS) vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser.

A compromised authentication token may grant administrative access to the Fleet API, allowing an attacker to perform privileged actions such as deploying scripts to managed hosts.

This issue does not allow unauthenticated access and does not affect instances where Windows MDM is disabled.

### Patches

- 4.78.2
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-gfpw-jgvr-cw4j
Package: github.com/fleetdm/fleet (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.75.0, < 4.75.2
Patched in: 4.75.2

Summary: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Details:
### Summary

A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices.

### Impact

If Windows MDM is enabled, an attacker could exploit a cross-site scripting (XSS) vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser.

A compromised authentication token may grant administrative access to the Fleet API, allowing an attacker to perform privileged actions such as deploying scripts to managed hosts.

This issue does not allow unauthenticated access and does not affect instances where Windows MDM is disabled.

### Patches

- 4.78.2
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-gfpw-jgvr-cw4j
Package: github.com/fleetdm/fleet (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.76.0, < 4.76.2
Patched in: 4.76.2

Summary: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Details:
### Summary

A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices.

### Impact

If Windows MDM is enabled, an attacker could exploit a cross-site scripting (XSS) vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser.

A compromised authentication token may grant administrative access to the Fleet API, allowing an attacker to perform privileged actions such as deploying scripts to managed hosts.

This issue does not allow unauthenticated access and does not affect instances where Windows MDM is disabled.

### Patches

- 4.78.2
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-gfpw-jgvr-cw4j
Package: github.com/fleetdm/fleet (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.77.0, < 4.77.1
Patched in: 4.77.1

Summary: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Details:
### Summary

A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices.

### Impact

If Windows MDM is enabled, an attacker could exploit a cross-site scripting (XSS) vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser.

A compromised authentication token may grant administrative access to the Fleet API, allowing an attacker to perform privileged actions such as deploying scripts to managed hosts.

This issue does not allow unauthenticated access and does not affect instances where Windows MDM is disabled.

### Patches

- 4.78.2
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.
GitHub Security Advisory: GHSA-gfpw-jgvr-cw4j
Package: github.com/fleetdm/fleet (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.78.0, < 4.78.2
Patched in: 4.78.2

Summary: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Details:
### Summary

A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices.

### Impact

If Windows MDM is enabled, an attacker could exploit a cross-site scripting (XSS) vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser.

A compromised authentication token may grant administrative access to the Fleet API, allowing an attacker to perform privileged actions such as deploying scripts to managed hosts.

This issue does not allow unauthenticated access and does not affect instances where Windows MDM is disabled.

### Patches

- 4.78.2
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

We thank @secfox-ai for responsibly reporting this issue.