PT-2025-6330

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a use-after-free memory vulnerability. This could allow an attacker to execute arbitrary...

CVE-2025-21177

Server-Side Request Forgery SSRF in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network...

CVE-2025-21177

Server-side request forgery ssrf in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network...

CVE-2025-21177 Microsoft Dynamics 365 Sales Elevation of Privilege Vulnerability

...

CVE-2025-21177

CVE-2025-21177 : Microsoft Dynamics 365 Sales contains a Server-Side Request Forgery (SSRF) that can enable an authenticated attacker to elevate privileges over the network. The issue is documented in multiple feeds (NVD, Microsoft MSRC) with high CVSS scores (8.7–8.8). Public details confirm the...

CVE-2025-21177 Microsoft Dynamics 365 Sales Elevation of Privilege Vulnerability

...

Microsoft Dynamics 365 Sales Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network...

PT-2025-5885 · Microsoft · Dynamics 365 Sales

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 Sales affected versions not specified Description: The issue allows an authorized attacker to elevate privileges over a network through a Server-Side Request Forgery SSRF in Microsoft Dynamics 365 Sales. Recommendations...

Microsoft Dynamics 365 代码问题漏洞

Microsoft Dynamics 365 Sales is a powerful tool designed to streamline and enhance the sales process, providing sales teams with the insights and data to build strong customer relationships and close deals effectively. An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Sales...

Cybercriminals Use Go Resty and Node Fetch in 13 Million Password Spraying Attempts

Cybercriminals are increasingly leveraging legitimate HTTP client tools to facilitate account takeover ATO attacks on Microsoft 365 environments. Enterprise security company Proofpoint said it observed campaigns using HTTP clients Axios and Node Fetch to send HTTP requests and receive HTTP...

CVE-2024-12583

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

Security Updates for Microsoft Outlook Products C2R (January 2025)

The Microsoft Outlook Products are missing a security update. It is, therefore, affected by a remote code execution vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...

Vulnerability of Microsoft Office package applications, Microsoft 365 Apps for Enterprise, and Microsoft Access database management systems, related to buffer overflows in dynamic memory, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Office packages, Microsoft 365 Apps for Enterprise, and the Microsoft Access database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to deserialization mechanism flaws, which allows attackers to circumvent existing security restrictions.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

Release Information for Veeam Backup for Microsoft 365 8.1 and Cumulative Patches

More Recent Version Available Please find the latest version of Veeam Backup for Microsoft 365 here: Veeam Downloads - Latest Version Build Numbers and Versions of Veeam Backup for Microsoft 365 Requirements This release can be used to: update manually from a previous Veeam Backup for Microsoft 3...

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages, related to the misuse of a trusted pointer, allows an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of an untrusted pointer. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of Microsoft 365 Apps for Enterprise, Microsoft Office, and the Microsoft Access database management system arises from buffer overflows in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft 365 Apps for Enterprise, Microsoft Office, and the Microsoft Access database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Assignment of the ApplicationImpersonation Role Fails With Error

Challenge In Microsoft 365 organizations using modern app-only authentication, an attempt to assign the ApplicationImpersonation role, which is required for data restore with Veeam Explorer for Microsoft Exchange , fails with the following error:...

Telegram-Based “Sneaky 2FA” Phishing Kit Targets Microsoft 365 Accounts

Sneaky 2FA: New Phishing-as-a-Service targets Microsoft 365, leveraging sophisticated evasion techniques and a Telegram-based platform to steal credentials.…...

New 'Sneaky 2FA' Phishing Kit Targets Microsoft 365 Accounts with 2FA Code Bypass

Cybersecurity researchers have detailed a new adversary-in-the-middle AitM phishing kit that's capable of Microsoft 365 accounts with an aim to steal credentials and two-factor authentication 2FA codes since at least October 2024. The nascent phishing kit has been dubbed Sneaky 2FA by French...