150 matches found
cve-2025-32711
CVE-2025-32711 EchoLeak Detection Tool 🔐 Overview CVE-2025-32711, nicknamed "EchoLeak," is a critical zero-click vulnerability in Microsoft 365 Copilot that allowed attackers to exfiltrate sensitive organizational data without any user interaction. This repository contains detection and remediati...
aisecplus-week01-danielossai
🔐 AISec Plus — Week 1: Map the Threat Researcher: Daniel Ossai Repo: aisecplus-week01-danielossai Submitted: Week 1 · AISec Plus Bootcamp 📌 Incident Name & Date EchoLeak CVE-2025-32711 Discovered: January 2025 · Disclosed: June 2025 · Patched: June 2025 📝 What Happened Researchers at Aim Security...
EUVD-2026-82590
Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...
CVE-2026-78501
CVE-2026-78501 is a command injection vulnerability in Microsoft 365 Copilot's Business Chat , caused by improper neutralization of special elements used in a command. An unauthorized attacker can exploit it over a network to disclose information . The CVSS v3.1 score is 7.4 (HIGH) , with a vecto...
Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
CVE-2026-78501: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...
KLA91291 Multiple vulnerabilities in Microsoft Apps
Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Microsoft 365 Copilot...
PT-2026-95172
Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description Microsoft 365 Copilot's Business Chat contains a command injection flaw, which occurs when special elements used in a command are not properly neutralized. This allows an...
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability
...
EUVD-2026-48457
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-50517
CVE-2026-50517 describes a deserialization vulnerability in Microsoft 365 Copilot (M365 Copilot) that enables an authorized attacker to execute code over the network. The issue is triggered by deserializing untrusted data, with a critical CVSS v3.1 score (9.9, CRITICAL) and a network attack vecto...
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability
...
PT-2026-64203
Name of the Vulnerable Software and Affected Versions Microsoft M365 Copilot affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object,...
Microsoft 365 Copilot Intelligent Virtual Assistant Privilege Escalation
The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
CVE-2026-59864
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, "kiota plugin add" and "kiota plugin generate" with "-t APIPlugin" emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams...
Microsoft 365 Copilot iOS Privilege Escalation
The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant in iOS operating systems is related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...
CVE-2026-58617 M365 Copilot for iOS Elevation of Privilege Vulnerability
...