CVE-2025-21415 Azure AI Face Service Elevation of Privilege Vulnerability

...

CVE-2025-21415

CVE-2025-21415 affects Azure AI Face Service, where an authentication bypass by spoofing allows an authorized attacker to elevate privileges over a network. Public sources (NVD, MSRC) confirm a high-severity elevation-of-privilege flaw with CVSS v3.1 scores: NVD base 8.8 (C/H/I/A), Microsoft’s ve...

Azure AI Face Service Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network...

KLA79416 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure AI Face Service can be exploited remotely to gain privileges. 2. An...

Microsoft Azure AI Face Service 安全漏洞

Microsoft Azure AI Face Service is an artificial intelligence face service from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure AI Face Service that stems from bypassing authentication through spoofing allowing an authorized attacker to elevate privileges over the...

PT-2025-4230 · Microsoft · Azure Ai Face Service

Name of the Vulnerable Software and Affected Versions: Azure AI Face Service affected versions not specified Description: An authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. This issue has been exploited in real-world...

PT-2025-3036 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue is related to insufficient protection of service data in the Face Gallery component of watchOS, iOS, and iPadOS operating systems. ...

The vulnerability of the microprogrammed software of the multi-environmental electrical voltage measuring instrument PowerLogic HDPM6000 lies in the lack of checks for the integrity of messages during transmission over communication channels. This allows attackers to exploit their privileges.

The vulnerability of the Pro-Face GP-Pro EX automation project creation software and the Pro-face Remote HMI remote monitoring software lies in the lack of checks for the integrity of messages during transmission over communication channels. Exploiting this vulnerability allows a malicious actor ...

Schneider Electric Pro-face GP-Pro EX和Remote HMI 安全漏洞

Schneider Electric Pro-face GP-Pro EX and Schneider Electric Pro-face Remote HMI are both products of Schneider Electric, France.Schneider Electric Pro-face GP-Pro EX is an HMI operation management system. Schneider Electric Pro-face GP- EX is a human-machine interface operator management system,...

Gradio < 4.18.0 Vulnerability - CVE-2024-2206

The version of Gradio installed on the remote host is prior to 4.18.0. It is, therefore, affected by an SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the...

The Paper Passport Is Dying

Smartphones and face recognition are being combined to create new digital travel documents. The paper passport’s days are numbered—despite new privacy risks...

PT-2024-10223 · Pro Face · Pro-Face Remote Hmi +1

Name of the Vulnerable Software and Affected Versions: Pro-Face GP-Pro EX affected versions not specified Pro-face Remote HMI affected versions not specified Description: The issue is related to an improper enforcement of message integrity during transmission in a communication channel, which cou...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11394 Hugging Face Transformers Trax Model Deseri...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11393 Hugging Face Transformers MaskFormer Model D...

CVE-2024-11436 Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization an...

CVE-2024-11394

A flaw was found in the Trax model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...

CVE-2024-11393

A flaw was found in the MaskFormer model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...

CVE-2024-11392

A flaw was found in the MobileViTV2 model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...

EUVD-2024-34103

Deserialization of Untrusted Data in Hugging Face Transformers...

Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...