The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages, related to data type mixing errors, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to data type mixing errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

KLA84828 OSI vulnerability in Microsoft Apps

An information disclosure vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions. Original advisories CVE-2025-32711 Related products Microsoft-Copilot-Studio CVE list CVE-2025-32711 critical KB list...

The vulnerability of Microsoft Office packages, Microsoft 365 Apps for Enterprise, and the Microsoft Outlook email client arises from insufficient validation of input data, allowing an attacker to execute arbitrary code.

The vulnerabilities of Microsoft Office packages, Microsoft 365 Apps for Enterprise, and the Microsoft Outlook email client are related to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to execute arbitrary code...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2025-25212

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description EchoLeak is a critical zero-click vulnerability that allows an unauthorized remote attacker to exfiltrate sensitive organizational data from Microsoft 365 Copilot without any us...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Jun 2025)

This host is missing a critical security update according to Microsoft Office Click-to-Run update June 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages relates to the execution of operations beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2025-5139

A vulnerability was found in Qualitor 8.20/8.24. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php of the component Office 365-type Connection Handler. The manipulation of the argument...

CVE-2024-46625

An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file...

CVE-2023-32119

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin = 1.9.0 versions...

CVE-2023-28417

Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12...

CVE-2020-1050

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'. This CVE ID is unique from CVE-2020-1049...

CVE-2020-0656

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

CVE-2020-23726

There is a local denial of service vulnerability in Wise Care 365 5.5.4, attackers can cause computer crash BSOD...

CVE-2020-29550

An issue was discovered in URVE Build 24.03.2020. The password of an integration user account used for the connection of the MS Office 365 Integration Service is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext:...

CVE-2020-1063

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

Advisory Update on Cyber Threat Activity Targeting Commvault’s SaaS Cloud Application (Metallic)

Commvault is monitoring cyber threat activity targeting their applications hosted in their Microsoft Azure cloud environment. Threat actors may have accessed client secrets for Commvault’s Metallic Microsoft 365 M365 backup software-as-a-service SaaS solution, hosted in Azure. This provided the...

CVE-2019-1375

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

CVE-2018-8654

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'...

CVE-2013-2308

The 1 OWA Helper and 2 OSG Lite programs in SoftBank Online Service Gate allow remote authenticated users to discover their own passwords, and consequently bypass an Office 365 restriction, via unspecified vectors...