https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1326

The Microsoft Team Foundation Server or Azure DevOps Server is missing security updates. It is, therefore, affected by a cross-site scripting (XSS) vulnerability due to not properly sanitizing user-provided input. An authenticated, remote attacker can exploit this by sending a specially-crafted payload to the TFS or Azure DevOps server, which will get executed in the context of the user every time a user visits the compromised page.

CVE-2020-1326

medium

Tenable Plugins

medium