Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Jan 2025)

This host is missing a critical security update according to Microsoft Office Click-to-Run update January 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2025-1270 · Microsoft · 365 Apps For Enterprise +2

Name of the Vulnerable Software and Affected Versions: Microsoft Access affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a buffer overflow in dynamic memory, which can be exploited to execute arbitrary code. Thi...

Microsoft Outlook 安全漏洞

Microsoft Outlook is a suite of e-mail applications from Microsoft Corporation USA. A security vulnerability exists in Microsoft Outlook. An attacker exploiting this vulnerability could remotely execute code. The following products and editions are affected:Microsoft Office 2019 for 32-bit...

Security Updates for Microsoft Excel Products C2R (December 2024)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by a security vulnerability that could allow arbitrary code to run when a maliciously modified file is opened. Note that Nessus has not tested for these issues but has instead relied only on the application's...

Security Updates for Microsoft Word Products C2R (November 2024)

The Microsoft Word Products are missing a security update. It is, therefore, affected by a security feature bypass vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2024-12583

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

CVE-2024-12583 Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

CVE-2024-12583

CVE-2024-12583 affects the Dynamics 365 Integration plugin for WordPress (versions up to and including 1.3.23). Root cause: missing input validation on the render function enables Twig Server-Side Template Injection. Impact: authenticated attackers with Contributor-level access and above can exec...

CVE-2024-12583 Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

WordPress plugin Dynamics 365 Integration 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1899 · Microsoft · Dynamics 365 Integration Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Dynamics 365 Integration plugin for WordPress version 1.3.23 and earlier Description: The issue is related to Remote Code Execution and Arbitrary File Read due to missing input validation and sanitization on the render function, allowing...

WordPress Dynamics 365 Integration plugin <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability

Authenticated Contributor+ Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Dynamics 365 Integration versions = 1.3.23...

Microsoft Office 365 (2016 Click-to-Run) RCE Vulnerability (Jan 2025)

This host is missing a critical security update according to Microsoft Office Click-to-Run update January 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API

Details have emerged about three now-patched security vulnerabilities in Dynamics 365 and Power Apps Web API that could result in data exposure. The flaws, discovered by Melbourne-based cybersecurity company Stratus Security, have been addressed as of May 2024. Two of the three shortcomings resid...

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses stems from deficiencies in the authentication process, which allows unauthorized users to elevate their privileges.

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...

Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service

An interruption to the phishing-as-a-service PhaaS toolkit called Rockstar 2FA has led to a rapid uptick in activity from another nascent offering named FlowerStorm. "It appears that the Rockstar2FA group running the service experienced at least a partial collapse of its infrastructure, with page...

Vulnerability of Microsoft Office packages, Microsoft 365 Apps, Microsoft SharePoint Server, and Microsoft SharePoint Enterprise Server: This vulnerability stems from operations that occur outside of the buffer in memory, allowing attackers to execute arbitrary code.

Packages such as Microsoft Office, Microsoft 365 Apps, Microsoft SharePoint Server, and Microsoft SharePoint Enterprise Server are associated with operations that involve writing data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the Microsoft Access database management system, Microsoft Office applications, and 365 Enterprise Apps relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Access database management systems, Microsoft Office applications, and 365 Enterprise Apps is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created malicious file...

AuthQuake Flaw Allowed MFA Bypass Across Azure, Office 365 Accounts

SUMMARY Cybersecurity researchers at Oasis Security have identified a vulnerability in Microsoft's Multi-Factor Authentication MFA, known as AuthQuake,…...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Dec 2024)

This host is missing a critical security update according to Microsoft Office Click-to-Run update December 2024. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...