2017-11-17-Maldoc-Using-CVE-2017-0199

このリポジトリには README がありません。...

CVE-2021-40444

CVE-2021-40444 PoC CVE-2021-40444를 악용하는 악성 docx 생성기 Microsoft Office Word 원격 코드 실행 이 스크립트의 생성은 실제 환경에서 사용된 샘플938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52, docx 파일에 대한 일부 리버스 엔지니어링을 기반으로 합니다. 먼저 lcab을 설치해야 합니다 sudo apt-get install lcab 수동 재현 단계는 REPRODUCE.md를 확인하세요 생성된 cab이 작동하...

CVE-2022-30190

CVE-2022-30190 https://github.com/JohnHammond/msdt-follina に基づく 環境設定 /env-setup内のファイルを使用 1. 仮想マシン: VirtualBox と Win1021H2Englishx32.iso を使用 ビルド 19044.1288 2. Microsoft Word をインストールし、/env-setup/odt-2013 内で cmd を使用して setup.exe /configure configuration.xml を実行 3. Python 3.8.10 をインストール エクスプロイト 1...

TIC4301_Project

TIC4301Project TIC4301 프로젝트 - CVE-2021-40444 다음 vagrant 박스를 다운로드하십시오: Kali - https://drive.google.com/file/d/1RegQcT2jjFoaQRgLjXDYl4iS0HNtmU2/view?usp=sharing Win10 - https://drive.google.com/file/d/1zcLertRoI-FrHDkRq1NO-KHaF88bMv6e/view?usp=sharing 다음 명령어를 사용하여 vagrant를 통해 박스를 가져오십시오: 1. vagrant...

Maldoc-Analysis

Maldoc-Analysis 2023년 3월, 새로운 샘플이 악성코드로 식별되었습니다. 해당 악성코드는 확장자가 .xls 및 .doc인 파일에서 비롯되었으며, "Bank Slip.xls"라는 이름으로 알려져 있습니다. 이 악성코드의 활동은 CVE-2017-11882 및 CVE-2018-0802로 알려진 취약점과 관련이 있습니다...

CVE-2022-30190-Analysis-With-LetsDefends-Lab

CVE-2022-30190-Analysis-With-LetsDefends-Lab 2022년 5월 27일, NaoSec 기술팀이 악의적으로 보이는 .doc 형식의 문서를 분석하여 발견했습니다. 해당 문서는 벨로루시 IP 주소에서 업로드된 것으로 확인되었습니다. 이러한 의심은 더 추적되었고, 2022년 5월 30일 월요일에 Microsoft가 CVE-2022-30190이라는 제로데이 징후를 발표했습니다. 악성 파일은 이탈리아의 폴리나Follina 마을에 있는 지역 코드 0438을 가리키는 것으로 확인되었습니다. 이에 따라 이...

EulerOS 2.0 SP13 : python-pillow (EulerOS-SA-2026-2992)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

TencentOS Server 3: evince (TSSA-2026:0620)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0620 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 2: compat-poppler022 (TSSA-2026:0651)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0651 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

PT-2026-59511

Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. Patches Patched version: 12.2.0. PdfParser introduced in Pillow 4.2.0 follows Prev pointers in PDF trailers to read cross-reference sections. If ...

CVE-2026-57259 Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local path...

PT-2026-56358

Name of the Vulnerable Software and Affected Versions Foxit Reader affected versions not specified Description An XML External Entity XXE issue exists where the application processes files that are not strictly in a structurally valid PDF format. By opening a malicious document disguised as a PDF...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent...

CVE-2026-48155

A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive memory consumption. This occurs when extracting text in layout mode with large character offsets. This vulnerability can result in a Denia...

PT-2026-40314

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0...

PT-2026-37199

Name of the Vulnerable Software and Affected Versions Pillow versions 4.2.0 through 12.1.x Description A flaw in the PdfParser allows an attacker to supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This occurs because...

CVE-2026-23863

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of...

CVE-2026-40980

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...