microsoft azure devops server

Name: microsoft azure devops server
Brand: microsoft

productUS

cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

by severity

2critical4high22medium0low

updated 2026-10-28

vulnerabilities (40)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-1306US	critical9.8	17.0% (97th)	—	no fix	2019-09-11	2 versions
CVE-2019-1072US	critical9.8	13.4% (96th)	—	no fix	2019-07-15	= 2019.0.1
CVE-2019-0971US	medium6.5	8.46% (95th)	—	no fix	2019-05-16	= 2019
CVE-2019-0857US	medium6.5	3.86% (90th)	—	no fix	2019-04-09	= 2019
CVE-2019-0875US	high7.5	3.02% (87th)	—	no fix	2019-04-09	= 2019
CVE-2021-27067US	medium4.0	2.65% (86th)	—	no fix	2021-04-13	3 versions
CVE-2019-0866US	medium6.1	2.63% (85th)	—	no fix	2019-04-09	= 2019
CVE-2019-0871US	medium6.1	2.42% (84th)	—	no fix	2019-04-09	= 2019
CVE-2019-0870US	medium6.1	2.42% (84th)	—	no fix	2019-04-09	= 2019
CVE-2019-0868US	medium6.1	2.42% (84th)	—	no fix	2019-04-09	= 2019
CVE-2019-0867US	medium6.1	2.39% (84th)	—	no fix	2019-04-09	= 2019
CVE-2021-28459US	medium4.3	2.32% (83rd)	—	no fix	2021-04-13	= 2020.0.1
CVE-2020-0758US	high7.5	2.02% (81st)	—	no fix	2020-03-12	2 versions
CVE-2019-0874US	medium6.1	1.98% (80th)	—	no fix	2019-04-09	—
CVE-2019-0869US	medium6.1	1.96% (80th)	—	no fix	2019-04-09	= 2019
CVE-2020-1327US	medium6.1	1.87% (79th)	—	no fix	2020-06-09	2 versions
CVE-2020-0815US	high7.5	1.84% (79th)	—	no fix	2020-03-12	= 2019
CVE-2019-0979US	medium5.4	1.70% (77th)	—	no fix	2019-05-16	= 2019
CVE-2019-0872US	medium5.4	1.70% (77th)	—	no fix	2019-05-16	= 2019
CVE-2023-33136US	—	1.68% (77th)	—	no fix	2023-09-12	5 versions
CVE-2020-1325US	medium5.5	1.63% (76th)	—	no fix	2020-11-11	= 2019
CVE-2019-1076US	medium5.4	1.63% (76th)	—	no fix	2019-07-15	= 2019.0.1
CVE-2024-35267US	—	1.58% (75th)	—	no fix	2024-07-09	= 2022.1.0
CVE-2024-35266US	—	1.58% (75th)	—	no fix	2024-07-09	= 2022.1.0
CVE-2019-0996US	medium6.5	1.57% (75th)	—	no fix	2019-06-12	= 2019
CVE-2020-1326US	medium5.4	1.57% (75th)	—	no fix	2020-07-14	2 versions
CVE-2020-17145US	medium4.9	1.55% (75th)	—	no fix	2020-12-10	3 versions
CVE-2019-1305US	medium5.4	1.54% (75th)	—	no fix	2019-09-11	= 2019.0.1
CVE-2023-21553US	—	1.42% (73rd)	—	no fix	2023-02-14	= 2020.1.2
CVE-2024-20667US	—	1.36% (72nd)	—	no fix	2024-02-13	3 versions
CVE-2020-17135US	medium4.9	1.33% (71st)	—	no fix	2020-12-10	2 versions
CVE-2020-0700US	medium5.4	1.33% (71st)	—	no fix	2020-03-12	= 2019.0.1
CVE-2023-38155US	high8.1	1.32% (71st)	—	no fix	2023-09-12	5 versions
CVE-2026-21512US	—	1.03% (63rd)	—	2022.2.0	2026-02-10	2 versions
CVE-2023-21751US	—	0.98% (62nd)	—	no fix	2023-12-14	2 versions
CVE-2023-21565US	—	0.93% (61st)	—	no fix	2023-06-14	3 versions
CVE-2023-36561US	—	0.90% (60th)	—	no fix	2023-10-10	3 versions
CVE-2023-21564US	—	0.89% (59th)	—	no fix	2023-02-14	= 2022
CVE-2023-36869US	—	0.70% (53rd)	—	no fix	2023-08-08	4 versions
CVE-2023-21569US	—	0.68% (52nd)	—	no fix	2023-06-14	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')20 CVEs
CWE-20Improper Input Validation6 CVEs
CWE-451User Interface (UI) Misrepresentation of Critical Information4 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')4 CVEs
CWE-116Improper Encoding or Escaping of Output2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-264CWE-2642 CVEs
CWE-269Improper Privilege Management2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE40 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan