Codeguard-copilot

CodeGuard Copilot — インテリジェント・セキュリティ・エコシステム AI搭載のセキュリティ・ガーディアン — ライブ攻撃者インテリジェンスに接続 機能 • アーキテクチャ • Raven連携 • インストール • ロードマップ • コントリビューション CodeGuard Copilotとは？ CodeGuard Copilotは、コミット後ではなくコーディング中に セキュリティ脆弱性を検出します。決定論的な正規表現パターン検出と、AIによる深層分析、そしてRaven/WraithWallエコシステムからのライブ攻撃者インテリジェンスを組み合わせることで、他のどのVS...

aisecplus-week01-danielossai

🔐 AISec Plus — 第 1 周：绘制威胁图景 研究人员： Daniel Ossai 代码库： aisecplus-week01-danielossai 提交： 第 1 周 · AISec Plus 训练营 📌 事件名称与日期 EchoLeak CVE-2025-32711 发现时间：2025 年 1 月 · 披露时间：2025 年 6 月 · 修复时间：2025 年 6 月 📝 发生了什么 Aim Security 的研究人员在 Microsoft 365 Copilot 中发现了一个严重的零点击间接提示注入漏洞。攻击者只需发送一封精心构造的电子邮件——无需任何用户交互——即可...

Vidar-Stealer-Reverse-Engineering

Vidar Stealer 2.0 リバースエンジニアリング分析 概要 本分析では、高度な回避技術を駆使して検出を免れる洗練された情報窃取型マルウェア Vidar Stealer 2.0 の徹底的なリバースエンジニアリングについて説明します。主な発見には以下が含まれます。 タスクスケジューラの改ざん: システムタスクのタイムスタンプを1999年に変更し、フォレンジック解析を回避します。 Explorer.exe のプロセスハローイング: 正当な Windows Explorer プロセスにシェルコードを注入します。 Microsoft Copilot への注入: ステルス実行のために新し...

CVE-2026-19775 OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775 OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.1.7 . The root cause is the plugin's failure to properly verify user authorization before performing certain actions. This flaw a...

EUVD-2026-82600

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

EUVD-2026-82582

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82588

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

CVE-2026-85887

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

CVE-2026-85885

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

CVE-2026-55946

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-85887

CVE-2026-85887 is an information disclosure vulnerability in M365 Copilot caused by an incorrect permission assignment on a critical resource. An attacker with low privileges (authorized access) can disclose information over a network. The CVSS 3.1 score is 7.7 (HIGH) with a changed scope and hig...

CVE-2026-78501

CVE-2026-78501 is a command injection vulnerability in Microsoft 365 Copilot's Business Chat , caused by improper neutralization of special elements used in a command. An unauthorized attacker can exploit it over a network to disclose information . The CVSS v3.1 score is 7.4 (HIGH) , with a vecto...

CVE-2026-85885

Microsoft 365 Copilot is affected by a command injection vulnerability, classified as improper neutralization of special elements used in a command. An authorized attacker (low privileges required) can exploit this over the network without user interaction to elevate privileges , with the attack ...

CVE-2026-55946

CVE-2026-55946 is a command injection vulnerability in Microsoft Copilot resulting from improper neutralization of special elements used in a command. An unauthorized remote attacker can leverage this to disclose information over a network . The CVSS 3.1 score is 6.1 (MEDIUM) with the vector AV:N...

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

M365 Copilot Information Disclosure Vulnerability

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...