The vulnerability of the Microsoft Azure AI Face Service, a cloud-based facial recognition and analysis service using artificial intelligence technologies, relates to the ability to bypass authentication through spoofing. This allows attackers to elevate their privileges.

The vulnerability of the Microsoft Azure AI Face Service, a cloud-based facial recognition and analysis service using artificial intelligence technologies, relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability can allow unauthorized actors to gain increas...

The vulnerability of the Face Gallery component in operating systems like watchOS and iOS allows a perpetrator to disclose protected information.

The vulnerability of the Face Gallery component in operating systems such as watchOS, iOS, and iPadOS is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection

Cybersecurity researchers have uncovered two malicious machine learning ML models on Hugging Face that leveraged an unusual technique of "broken" pickle files to evade detection. "The pickle files extracted from the mentioned PyTorch archives revealed the malicious Python content at the beginning...

CVE-2022-41668

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfix 1...

CVE-2022-41666

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfix 1 or prior, Pro-face...

CVE-2022-41671

A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...

CVE-2022-41667

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3 Hotfi...

CVE-2022-41669

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal ExpertV3.3...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on February 4, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-035-01 Western Telematic Inc NPS Series, DSM Series, CPM Series ICSA-25-035-02 Rockwe...

Microsoft Patches Critical Azure AI Face Service Vulnerability with CVSS 9.9 Score

Microsoft has released patches to address two Critical-rated security flaws impacting Azure AI Face Service and Microsoft Account that could allow a malicious actor to escalate their privileges under certain conditions. The flaws are listed below - CVE-2025-21396 CVSS score: 7.5 - Microsoft Accou...

CVE-2025-21415

Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network...

CVE-2025-21415 Azure AI Face Service Elevation of Privilege Vulnerability

...

CVE-2025-21415

CVE-2025-21415 affects Azure AI Face Service, where an authentication bypass by spoofing allows an authorized attacker to elevate privileges over a network. Public sources (NVD, MSRC) confirm a high-severity elevation-of-privilege flaw with CVSS v3.1 scores: NVD base 8.8 (C/H/I/A), Microsoft’s ve...

CVE-2025-21415 Azure AI Face Service Elevation of Privilege Vulnerability

...

Azure AI Face Service Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network...

KLA79416 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure AI Face Service can be exploited remotely to gain privileges. 2. An...

Microsoft Azure AI Face Service 安全漏洞

Microsoft Azure AI Face Service is an artificial intelligence face service from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure AI Face Service that stems from bypassing authentication through spoofing allowing an authorized attacker to elevate privileges over the...

PT-2025-4230 · Microsoft · Azure Ai Face Service

Name of the Vulnerable Software and Affected Versions: Azure AI Face Service affected versions not specified Description: An authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. This issue has been exploited in real-world...

PT-2025-3036 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue is related to insufficient protection of service data in the Face Gallery component of watchOS, iOS, and iPadOS operating systems. ...

The vulnerability of the microprogrammed software of the multi-environmental electrical voltage measuring instrument PowerLogic HDPM6000 lies in the lack of checks for the integrity of messages during transmission over communication channels. This allows attackers to exploit their privileges.

The vulnerability of the Pro-Face GP-Pro EX automation project creation software and the Pro-face Remote HMI remote monitoring software lies in the lack of checks for the integrity of messages during transmission over communication channels. Exploiting this vulnerability allows a malicious actor ...