127 matches found
M365-Assess
M365 Assess Comprehensive M365 Security Assessment Tool Read-only Microsoft 365 security assessment for IT consultants and administrators What is this? M365 Assess runs a single read-only command against a Microsoft 365 tenant and produces CSV data, a self-contained branded HTML report, and an XL...
untitledgoosetool
Untitled Goose Tool The Goose is loose. Table of Contents About Getting Started Prerequisites Requirements Installing Usage Config GUI Auth Csv Honk Messagetrace Recommended Default Workflow Recommended Workflow for UAL Call with Time Bounds Considerations Known Issues Acknowledgements Contributi...
EUVD-2026-82600
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
EUVD-2026-82588
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
CVE-2026-85887
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
CVE-2026-85887: Incorrect Permission Assignment for Critical Resource
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
CVE-2026-85885
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
CVE-2026-85887
CVE-2026-85887 is an information disclosure vulnerability in M365 Copilot caused by an incorrect permission assignment on a critical resource. An attacker with low privileges (authorized access) can disclose information over a network. The CVSS 3.1 score is 7.7 (HIGH) with a changed scope and hig...
CVE-2026-85885
Microsoft 365 Copilot is affected by a command injection vulnerability, classified as improper neutralization of special elements used in a command. An authorized attacker (low privileges required) can exploit this over the network without user interaction to elevate privileges , with the attack ...
M365 Copilot Information Disclosure Vulnerability
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
CVE-2026-85885: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
PT-2026-95174
Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an authorized attacker to elevate privileges over a network. Recommendations At the...
PT-2026-95184
Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description Incorrect permission assignment for a critical resource allows an authorized attacker to disclose information over a network. Recommendations At the moment, there is no information about...
MINI-V4H3-M365-FP9C
Bulletin has no description...
Microsoft Word Office Suites Microsoft 365 Apps Disclosure
The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise involves reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...
Web Portal Cloud Services Privilege Escalation
The vulnerability of the web portal for managing cloud services, accounts, subscriptions, and the security of the Microsoft 365 Admin Center is related to errors in verifying cryptographic signatures. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotel...
CVE-2026-16053
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module...
CVE-2026-16053
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module...
