CVE-2022-41668

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfix 1...

CVE-2022-41666

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfix 1 or prior, Pro-face...

CVE-2022-41671

A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...

CVE-2022-41667

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfi...

CVE-2022-41669

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on February 4, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-035-01 Western Telematic Inc NPS Series, DSM Series, CPM Series ICSA-25-035-02 Rockwe...

Microsoft Patches Critical Azure AI Face Service Vulnerability with CVSS 9.9 Score

Microsoft has released patches to address two Critical-rated security flaws impacting Azure AI Face Service and Microsoft Account that could allow a malicious actor to escalate their privileges under certain conditions. The flaws are listed below - CVE-2025-21396 CVSS score: 7.5 - Microsoft Accou...

CVE-2025-21415

Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network...

CVE-2025-21415

CVE-2025-21415 affects Azure AI Face Service, where an authentication bypass by spoofing allows an authorized attacker to elevate privileges over a network. Public sources (NVD, MSRC) confirm a high-severity elevation-of-privilege flaw with CVSS v3.1 scores: NVD base 8.8 (C/H/I/A), Microsoft’s ve...

CVE-2025-21415 Azure AI Face Service Elevation of Privilege Vulnerability

...

CVE-2025-21415 Azure AI Face Service Elevation of Privilege Vulnerability

...

Azure AI Face Service Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network...

KLA79416 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure AI Face Service can be exploited remotely to gain privileges. 2. An...

Microsoft Azure AI Face Service 安全漏洞

Microsoft Azure AI Face Service is an artificial intelligence face service from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure AI Face Service that stems from bypassing authentication through spoofing allowing an authorized attacker to elevate privileges over the...

PT-2025-4230 · Microsoft · Azure Ai Face Service

Name of the Vulnerable Software and Affected Versions: Azure AI Face Service affected versions not specified Description: An authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. This issue has been exploited in real-world...

CVE-2025-21415: Authentication Bypass by Spoofing

Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network...

PT-2025-3036 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue is related to insufficient protection of service data in the Face Gallery component of watchOS, iOS, and iPadOS operating systems. ...

The vulnerability of the microprogrammed software of the multi-environmental electrical voltage measuring instrument PowerLogic HDPM6000 lies in the lack of checks for the integrity of messages during transmission over communication channels. This allows attackers to exploit their privileges.

The vulnerability of the Pro-Face GP-Pro EX automation project creation software and the Pro-face Remote HMI remote monitoring software lies in the lack of checks for the integrity of messages during transmission over communication channels. Exploiting this vulnerability allows a malicious actor ...

Schneider Electric Pro-face GP-Pro EX和Remote HMI 安全漏洞

Schneider Electric Pro-face GP-Pro EX and Schneider Electric Pro-face Remote HMI are both products of Schneider Electric, France.Schneider Electric Pro-face GP-Pro EX is an HMI operation management system. Schneider Electric Pro-face GP- EX is a human-machine interface operator management system,...

Gradio < 4.18.0 Vulnerability - CVE-2024-2206

The version of Gradio installed on the remote host is prior to 4.18.0. It is, therefore, affected by an SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the...