OneNoteAnalyzer

OneNoteAnalyzer 一款基于C的工具，用于分析恶意OneNote文档 描述 最近，我们遇到了一些由不同威胁行为者在野外传播的恶意OneNote文档。这促使我们开发了"OneNoteAnalyzer"，它有助于在不执行这些恶意OneNote文档的情况下进行分析。现在，让我们看看该工具提供的功能。 功能 在提供恶意OneNote文档的文件路径后，OneNoteAnalyzer会提取： OneNote文档中的附件，以及实际的附件路径、文件名和大小 OneNote文档的页面元数据——标题、作者、创建时间、最后修改时间 OneNote文档中的图片，以及可能存在的超链接URL...

pyOneNote

pyOneNote pyOneNote 是一个轻量级的 Python 库，用于读取 OneNote 文件。该解析器的主要目标是让网络安全分析师能够从 OneNote 文件中提取有用信息。 安装解析器 安装最新开发版本 root@kitploit: pip install -U https://github.com/DissectMalware/pyOneNote/archive/master.zip --force 运行解析器 将当前目录中的所有嵌入文件导出 root@kitploit: pyonenote -f example.one 将 example.one 中的所有嵌入文件导出到...

CABTrap_OneNote2007

CABTrapOneNote2007 Microsoft Office OneNote 2007 CVE-2014-2815 Vulnerabilidad de recorrido de directorio en archivos ".ONEPKG" que conduce a la ejecución arbitraria de código Microsoft Office OneNote 2007 CVE-2014-2815 Vulnerabilidad de recorrido de directorio en archivos ".ONEPKG" que conduce a ...

CVE-2026-46671 Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...

CVE-2026-46671

This CVE concerns the Rust-based onenote_parser. Prior to version 1.1.1, a crafted .onetoc2 file could cause Parser::parse_notebook to open files outside the notebook directory by joining entry names with the notebook base, without ensuring relative paths. The issue allows file-existence probing ...

CVE-2026-55133

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally...

CVE-2026-55133 Microsoft OneNote Remote Code Execution Vulnerability

...

CVE-2026-55133 Microsoft OneNote Remote Code Execution Vulnerability

...

CVE-2026-55133

CVE-2026-55133 affects Microsoft Office OneNote. The issue is a heap-based buffer overflow in OneNote that can allow a local attacker to execute code on the affected system. CVSSv3.1 indicates ATT&CK: local access, user interaction required, with high impact to confidentiality, integrity, and ava...

Microsoft OneNote Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally...

Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory

Impact A maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the .onetoc2 and joins them against the notebook's base directory without...

GHSA-4J5M-WC25-PVH7 Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory

Impact A maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the .onetoc2 and joins them against the notebook's base directory without...

PT-2026-42595

Impact A maliciously crafted .onetoc2 table-of-contents file can cause Parser::parse notebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the .onetoc2 and joins them against the notebook's base directory without...

CVE-2026-22810

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded...

Directory Traversal

Overview @joplin/onenote-converter is an Used to import a OneNote archive into Joplin Affected versions of this package are vulnerable to Directory Traversal via the OneNote importer. An attacker can overwrite arbitrary files on disk by supplying a crafted .one file containing specially crafted...

CVE-2026-22810

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded...

CVE-2026-22810 Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded...

CVE-2026-22810 Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded...

CVE-2026-22810

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded...

EUVD-2026-30806

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded...