July “In the Trend of VM” (#17): vulnerabilities in Microsoft Windows and Roundcube

July "In the Trend of VM" 17: vulnerabilities in Microsoft Windows and Roundcube. A traditional monthly roundup. This time, it's a very short one. Post on Habr rus Digest on the PT website rus Only three trending vulnerabilities: Remote Code Execution - Internet Shortcut Files CVE-2025-33053...

Microsoft Office Elevation of Privilege Vulnerability (CNVD-2025-16690)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, and so on. An elevation of privilege vulnerability exists in Microsoft Office, which is due to untrusted data...

Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2025-16776)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...

Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2025-16778)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...

Microsoft Graphics Component elevation of privilege vulnerability (CNVD-2025-17137)

Microsoft Graphics Component is a graphics driver component of Microsoft Corporation USA. A security vulnerability exists in Microsoft Graphics Component. An attacker could exploit the vulnerability to elevate privileges...

Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2025-16779)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...

Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2025-16777)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...

CVE-2025-47158

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-47158

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-53762 Microsoft Purview Elevation of Privilege Vulnerability

...

CVE-2025-53762 Microsoft Purview Elevation of Privilege Vulnerability

...

CVE-2025-53762

CVE-2025-53762 — Microsoft Purview Elevation of Privilege . Affected product: Microsoft Purview. Description in sources: a permissive list of allowed inputs can enable an authorized attacker to elevate privileges over a network. The vulnerability is described as a network-exploitable privilege es...

CVE-2025-47158 Azure DevOps Server Elevation of Privilege Vulnerability

...

CVE-2025-47158 Azure DevOps Server Elevation of Privilege Vulnerability

...

CVE-2025-47995 Azure Machine Learning Elevation of Privilege Vulnerability

...

CVE-2025-47995

Azure Machine Learning is identified in CVE-2025-47995 as having weak authentication that enables a network-based privilege escalation by an authorized attacker. The entry derives from Microsoft/Red Hat and multiple security sources, describing the vulnerability as affecting Microsoft Azure Machi...

CVE-2025-47995 Azure Machine Learning Elevation of Privilege Vulnerability

...

CVE-2025-47158

Azure DevOps vulnerability CVE-2025-47158: Authentication bypass by assumed-immutable data can allow a network attacker to elevate privileges. Affected product: Azure DevOps Server/Services. Root cause: bypass of authentication via assumed-immutable data in Azure DevOps. Impact: privilege escalat...

CVE-2025-49746 Azure Machine Learning Elevation of Privilege Vulnerability

...

CVE-2025-49746

CVE-2025-49746 affects Microsoft Azure Machine Learning. The vulnerability is caused by improper authorization, enabling an attacker with network access to escalate privileges within the affected service. Documented impact is privilege escalation with high confidentiality, integrity, and availabi...