CVE-2025-20701

In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-20700

CVE-2025-20700 affects the Airoha Bluetooth audio SDK. The issue is a permission bypass that allows access to critical RACE protocol data via the Bluetooth LE GATT service, enabling remote escalation of privilege with no extra execution privileges and without user interaction. PT-2025-27362 confi...

The vulnerability of the Wlan AP Driver software driver from MediaTek’s microprogramming chips allows attackers to enhance their privileges.

The vulnerability of the Wlan AP Driver software driver from MediaTek is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Airoha Bluetooth audio SDK 安全漏洞

Airoha Bluetooth audio SDK is a software development kit from Airoha. Airoha Bluetooth audio SDK suffers from a security vulnerability that originates from unauthorized access to the RACE protocol and could result in remote elevation of privilege...

Airoha Bluetooth audio SDK 安全漏洞

Airoha Bluetooth audio SDK is a software development kit from Airoha. Airoha Bluetooth audio SDK has a security vulnerability that originates from a privilege bypass that could lead to remote elevation of privilege...

The vulnerability of the Wlan AP Driver software driver from MediaTek’s microprogramming chips allows attackers to enhance their privileges.

The vulnerability of the Wlan AP Driver software driver from MediaTek is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

The vulnerability of the Azure DevOps software development tool, related to bypassing authentication using supposedly immutable data, allows attackers to escalate their privileges.

The vulnerability of the Azure DevOps software development tool relates to bypassing authentication using supposedly immutable data. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

The vulnerability of the Microsoft Purview data management tool, related to the allowed lists of input data, allows a perpetrator to increase their privileges.

The vulnerability of the Microsoft Purview data management tool is related to allowed lists for input data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the FTP service provided by TOTOLINK N600R and X2000R microprogrammable router software allows attackers to increase their privileges.

The vulnerability of the FTP service provided by TOTOLINK N600R and X2000R microprogrammed router software is related to the improper assignment of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the GoldenDB database management system, related to insecure privilege management, allows attackers to elevate their privileges.

The vulnerability of the GoldenDB database management system is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Sherpa Orchestrator component of the Sherpa RPA process automation platform allows a perpetrator to enhance their privileges.

The vulnerability of the Sherpa Orchestrator component of the Sherpa RPA process automation platform is related to an error in processing authentication keys controlled by users. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the Input Method Editor (IME) component of Microsoft Windows, which allows a hacker to gain elevated privileges

The vulnerability of the Input Method Editor IME component in Microsoft Windows is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges remotely...

The vulnerability of the Public Update Page component in microprogramming software for Ethernet modules WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN allows attackers to enhance their privileges.

The vulnerability of the Public Update Page component in microprogramming software for Ethernet modules WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN is related to the absence of authentication for a critical function. Exploiting this vulnerability can allow an attacker to increase their privilege...

CVE-2025-47972

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges over a network...

The vulnerability of the microprogrammed software of Edimax EW-7438RPn Mini wireless signal amplifiers is related to insufficient verification of input data. This allows attackers to enhance their privileges and execute arbitrary commands.

The vulnerability of the microprogramming software of Edimax EW-7438RPn Mini wireless signal amplifiers is related to insufficient checking of input data during the processing of the final command /goform/mp. Exploiting this vulnerability can allow a remote attacker to enhance their privileges an...

The vulnerabilities in the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B allow attackers to enhance their privileges.

The vulnerabilities of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B systems are related to access control errors. Exploiting these vulnerabilities can allow attackers to enhance their privileges remotely...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to inadequate access control mechanisms, allows attackers to escalate their privileges.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

The vulnerability of the IhisiServiceSmm component in the InsydeH2O UEFI firmware creation framework allows a attacker to escalate their privileges.

The vulnerability of the IhisiServiceSmm component in the InsydeH2O UEFI firmware creation framework is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

The vulnerability in the JavaScript URI Handler component of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird allows a hacker to escalate their privileges.

The vulnerability of the JavaScript URI Handler component in Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird relates to reading data beyond the memory boundaries. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...