archiver-MOTW-support-comparison

Comparación de la compatibilidad con MOTW Mark of the Web del software de archivado para Windows Inglés | Japonés Antecedentes El 3 de marzo de 2022, Microsoft anunció que el comportamiento predeterminado de las aplicaciones de Office en Windows cambiará para bloquear las macros en archivos...

CVE-2022-30190

CVE-2022-30190（Follina）概念验证 概述 该项目演示了针对 CVE-2022-30190 （也称为 "Follina" ）的概念验证利用代码——这是一个通过 MSDT 协议影响 Microsoft Office 的严重远程代码执行漏洞。该应用程序生成恶意的 Office 文档，以说明该漏洞的工作流程，仅用于教育和研究目的 。 ⚠ 警告： 本仓库仅用于教育和授权的安全研究。 严禁 在生产环境或针对非您拥有或未经明确许可测试的系统使用。 功能特点 📝 生成利用 Follina 漏洞的 Office 文档 🌐 简单的 Web 界面用于创建载荷 🐳 提供 Docker...

CVE-2022-30190

Explotación de Follina CVE-2022-30190 Follina CVE-2022-30190 es una vulnerabilidad crítica de ejecución remota de comandos RCE que afecta a la Herramienta de diagnóstico de soporte de Microsoft MSDT. Esta falla fue descubierta originalmente a través de un archivo malicioso detectado en VirusTotal...

OffensiveVBA

OffensiveVBA 为了准备一场关于VBS AV规避的直播/视频，我正在研究Office宏代码执行方法及规避技术。 列表越来越长，而我没有找到一个集中存放攻击性VBA模板的地方——因此这个仓库可以用于此目的。它还远未完成。如果你知道任何其他有用的技术或模板，欢迎贡献并创建拉取请求！ 本仓库中的大多数模板已在其他地方发布过。我只是从微软文档网站、博客文章或其他工具中复制粘贴了大部分模板。 本仓库中的模板 文件| 描述 ---|--- ShellApplicationShellExecute.vba| 通过ShellApplication对象和ShellExecute方法执行操作系统命...

backdoorppt

backdoorppt - 'Office 扩展名伪装工具' root@kitploit: 版本发布：v1.7-稳定版 作者：pedro ubuntu r00t-3xp10it 支持发行版：Linux Kali, Ubuntu, Mint Suspicious-Shell-Activity© SSA 红队开发 @2017 将你的 payload.exe 伪装成一个虚假的 Word 文档 .ppt root@kitploit: 简单脚本，允许用户将一个现有的 executable.exe 添加 ms-word 图标 （使用 resource-hacker 作为后端应用程序） 并利用 Rub...

CVE-2021-40444

〖EXP〗Ladon CVE-2021-40444 Office漏洞复现 漏洞概述 北京时间9月8日，绿盟科技CERT监测到微软发布安全通告披露了Microsoft MSHTML 远程代码执行漏洞，攻击者可通过制作恶意的 ActiveX 控件供托管浏览器呈现引擎的 Microsoft Office文档使用，成功诱导用户打开恶意文档后，可在目标系统上以该用户权限执行任意代码。微软在通告中指出已检测到该漏洞被在野利用，请相关用户采取措施进行防护。 MSHTML（又称为Trident）是微软旗下的Internet Explorer 浏览器引擎，也用于 Office 应用程序，以在...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

Office-Malware-Forensics-Lab-REMnux-Static-Analysis

Laboratorio de Forense de Malware de Office — Análisis Estático con REMnux Resumen Análisis forense estático de dos documentos maliciosos de Microsoft Office utilizando REMnux y la suite oletools. No se ejecutó ningún archivo — todo el análisis se realizó de forma estática dentro de una máquina...

CVE-2026-64909

Microsoft Office is affected by CVE-2026-649909 due to an integer underflow, enabling local code execution. The root cause is a wrap/wraparound flaw in an Office component, with the impact described as local RCE. No specific affected versions or patches are provided in the supplied documents. Exp...

CVE-2026-63524 Microsoft Office Information Disclosure Vulnerability

...

CVE-2026-65661

Microsoft Office is affected by CVE-2026-65661 due to a heap-based buffer overflow that allows an attacker with local access to execute code on a vulnerable system. The CVSS 3.1 vector indicates a Local attack with user interaction required and a High impact on confidentiality, integrity, and ava...

CVE-2026-39904

Gophish 0.12.1 is affected by a denial-of-service in the ApplyTemplate() path that processes Office documents as ZIP archives. The vulnerability arises from ioutil.ReadAll() on each file entry without sized limits, enabling a zip-bomb payload to cause several gigabytes of in-memory expansion and ...

[SECURITY] Fedora 43 Update: python-wsgidav-4.3.4-1.fc43

A generic and extendable WebDAV server written in Python and based on WSGI. Main features: =E2=80=A2 WsgiDAV is a stand-alone WebDAV server with SSL support, that can be installed and run as Python command line script. =E2=80=A2 The python-pam library is needed as extra requirement if pam-login...

CVE-2026-46722 XML External Entity Injection in extension "Faceted Search" (ke_search)

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index...

EUVD-2025-209090

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided...

ALPINE-CVE-2025-59031

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability, which stems from the insecure handling of zip-format attachments by the attachment-to-text script. This vulnerability may allow...

CVE-2025-30190

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available...

EUVD-2025-199814

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available...

CVE-2025-30190

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available...