2017-11-17-Maldoc-Using-CVE-2017-0199

이 저장소에는 README가 없습니다...

CVE-2022-30190

CVE-2022-30190 https://github.com/JohnHammond/msdt-follina 기반 환경 설정 /env-setup에 있는 파일 사용 1. 가상 머신: VirtualBox와 Win1021H2Englishx32.iso 사용 빌드 19044.1288 2. Microsoft Word 설치, /env-setup/odt-2013 내에서 cmd로 setup.exe /configuration configuration.xml 실행 3. Python 3.8.10 설치 익스플로잇 1. Windows 설정에서 바이러스 및...

TIC4301_Project

TIC4301Project TIC4301 프로젝트 - CVE-2021-40444 다음 vagrant 박스를 다운로드하십시오: Kali - https://drive.google.com/file/d/1RegQcT2jjFoaQRgLjXDYl4iS0HNtmU2/view?usp=sharing Win10 - https://drive.google.com/file/d/1zcLertRoI-FrHDkRq1NO-KHaF88bMv6e/view?usp=sharing 다음 명령어를 사용하여 vagrant를 통해 박스를 가져오십시오: 1. vagrant...

Maldoc-Analysis

Maldoc-Analysis In March 2023, a new sample was identified as malware. The malware originated from files with .xls and .doc extensions and is known as "Bank Slip.xls". The malware's activity is related to vulnerabilities identified as CVE-2017-11882 and CVE-2018-0802...

CVE-2021-40444

CVE-2021-40444 PoC CVE-2021-40444를 악용하는 악성 docx 생성기 Microsoft Office Word 원격 코드 실행 이 스크립트의 생성은 실제 환경에서 사용된 샘플938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52, docx 파일에 대한 일부 리버스 엔지니어링을 기반으로 합니다. 먼저 lcab을 설치해야 합니다 sudo apt-get install lcab 수동 재현 단계는 REPRODUCE.md를 확인하세요 생성된 cab이 작동하...

CVE-2022-30190-Analysis-With-LetsDefends-Lab

CVE-2022-30190-Analysis-With-LetsDefends-Lab On May 27, 2022, the NaoSec technical team attempted to analyze and discovered a document in .doc format that appeared malicious. The document was indicated to have been uploaded from an IP address in Belarus. This suspicion was further traced and on M...

EulerOS 2.0 SP13 : python-pillow (EulerOS-SA-2026-2992)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

TencentOS Server 3: evince (TSSA-2026:0620)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0620 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 2: compat-poppler022 (TSSA-2026:0651)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0651 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

PT-2026-59511

Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. Patches Patched version: 12.2.0. PdfParser introduced in Pillow 4.2.0 follows Prev pointers in PDF trailers to read cross-reference sections. If ...

PT-2026-59640

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3839...

CVE-2026-57259 Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local path...

PT-2026-56358

Name of the Vulnerable Software and Affected Versions Foxit Reader affected versions not specified Description An XML External Entity XXE issue exists where the application processes files that are not strictly in a structurally valid PDF format. By opening a malicious document disguised as a PDF...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat 2024 lies in their ability to exploit memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat 2024 relates to the ability to utilize memory after decompression. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening the malicious file...

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat 2024 lies in their ability to exploit memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat 2024 relates to the ability to utilize memory after decompression. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening the malicious file...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

CVE-2026-48155

A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive memory consumption. This occurs when extracting text in layout mode with large character offsets. This vulnerability can result in a Denia...

PT-2026-40314

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0...