CVE-2025-49737 Microsoft Teams Elevation of Privilege Vulnerability

...

CVE-2025-49731 Microsoft Teams Elevation of Privilege Vulnerability

...

CVE-2025-49731 Microsoft Teams Elevation of Privilege Vulnerability

...

CVE-2025-49731

CVE-2025-49731 affects Microsoft Teams (Desktop). The vulnerability is due to improper handling of insufficient permissions or privileges, allowing an authorized attacker to elevate privileges over a network. Per the public metrics, the CVSSv3.1 base score is 3.1 (LOW) with Network attack vector,...

Microsoft Teams Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Teams allows an authorized attacker to elevate privileges locally...

Microsoft Teams Elevation of Privilege Vulnerability

Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network...

PT-2025-28623

Name of the Vulnerable Software and Affected Versions: Microsoft Teams affected versions not specified Description: The issue is related to concurrent execution using a shared resource with improper synchronization, also known as a 'race condition', in Microsoft Teams. This allows an authorized...

Microsoft Teams 安全漏洞

Microsoft Teams is a software from Microsoft USA for online meetings, chat, and cloud storage capabilities. A security vulnerability exists in Microsoft Teams. An attacker can exploit the vulnerability to elevate privileges. The following products and versions are affected: Microsoft Teams for...

Microsoft Teams 竞争条件问题漏洞

Microsoft Teams is a software used for online meetings, chat, and cloud storage capabilities by Microsoft Corporation USA. A competitive condition issue vulnerability exists in Microsoft Teams. An attacker can exploit the vulnerability to elevate privileges...

PT-2025-28619

Name of the Vulnerable Software and Affected Versions: Microsoft Teams affected versions not specified Description: The issue is related to the improper handling of permissions or privileges in Microsoft Teams, allowing an authorized attacker to elevate privileges over a network. This could...

Red Teaming AI Red Teaming

Red teaming has evolved from its origins in military applications to become a widely adopted methodology in cybersecurity and AI. In this paper, we take a critical look at the practice of AI red teaming. We argue that despite its current popularity in AI governance, there exists a significant gap...

SUSE CVE-2025-4128

Mattermost versions 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/teamid...

Bridging the Security Knowledge Gap: Introducing AI ExplAIn for Imperva Cloud WAF

The challenge of maintaining robust web application security often comes down to communication. Security teams frequently spend countless hours explaining WAF blocking decisions to application developers who may lack security expertise. This communication gap not only creates friction between tea...

Cloud Attacks Retrospective: Evolving Tactics, Familiar Entry Points

Let's break down eight attack patterns security teams should be watching in 2025...

Google Warns of Scattered Spider Attacks Targeting IT Support Teams at U.S. Insurance Firms

The notorious cybercrime group known as Scattered Spider aka UNC3944 that recently targeted various U.K. and U.S. retailers has begun to target major insurance companies, according to Google Threat Intelligence Group GTIG. "Google Threat Intelligence Group is now aware of multiple intrusions in t...

MAL-2025-5003 Malicious code in odyssee_teams_api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9634a76d594664463c45445417dd33af9980310ff86b362704e5b0b50daed079 Any computer that has this package installed or running should be considered...

Unauthorized Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Information Disclosure. The vulnerability is due to insufficient restriction of API access, allowing guest users to view information about public teams they are not members of via direct API calls...

GO-2025-3757 Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server

Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server...

Former Black Basta Members Use Microsoft Teams and Python Scripts in 2025 Attacks

Former members tied to the Black Basta ransomware operation have been observed sticking to their tried-and-tested approach of email bombing and Microsoft Teams phishing to establish persistent access to target networks. "Recently, attackers have introduced Python script execution alongside these...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization over the /api/v4/teams/teamid endpoint. A user can view information about public teams they are not a member of. Remediation Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 9.11.14,...