CVE-2026-52782

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-52782 CVE-2026-52782 OpenProject 17.3.2 - OpenProject GmbH I am @abraxasnull. Loopback lab. The client is CVE-2026-52782-Abraxas-Labs.py. IDOR on managed folders. Storages::ProjectStorages::BaseContract...

OneDrive-UDC2

OneDrive UDC2 A Cobalt Strike User-Defined C2 channel that uses OneDrive as the transport layer. What you need A Microsoft Entra ID tenant with a user that has OneDrive for Business. An app registration with the Files.ReadWrite.All application permission. Setup 1. Register an application In Azure...

CompMgmtLauncher_DLL_UACBypass

CompMgmtLauncher & Sharepoint DLL Search Order hijacking UAC/persist via OneDrive CompMgmtLauncher.exe is vulnerable to to a DLL Search Order hijacking vulnerability. The binary, will perform a search within user env for the DLL's Secur32.dll or Wininet.dll when Onedrive is installed...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

M365Pwned

M365Pwned Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API. Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens — no user interaction required. Tool| Target| What it does ---|---|---...

covert-control

covert-control Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram using Python to create the files and the listeners. It allows to create text files, images, audio or videos, with the commands in cleartext or encrypted using AES. covert-googledrive.py -...

SnaffPoint

SnaffPoint What is it SnaffPoint is a tool for pointesters who are in need of some sweetness in this world. It should help you find sensitive files available on SharePoint online and on shared OneDrive files for your company or your customer. How does it work There are actually 2 tools:...

CVE-2026-92204

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

EUVD-2026-107402

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

CVE-2026-92204

The Airbyte OneDrive Connector is vulnerable to a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in the _get_shared_drive_object method. The root cause is a lack of proper validation of a URI before the application accesses resources. This flaw allows an authenticated...

KnockKnock

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of KnockKnock or to submit an issue, reference https://github.com/waffl3ss/KnockKnock. KnockKnock - v0.9.9 Please make sure to actually utilize the README. Designed to validate potential usernames by querying OneDrive and/or Microsoft...

onedrive_user_enum

onedriveuserenum v2.10 Gültige OneDrive-Benutzer enumerieren Eine vollständige Erläuterung der Enumerationstechnik und der OneDrive-Enumeration finden Sie im Blog hier: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ Wenn Sie nach der alten Version ohne Datenbank der OneDrive-Enumerati...

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the...

Exploit for CVE-2026-52782

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-93986

A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to craft special names in server and third-party listing responses. These crafted names, containing directory traversal sequences, could potentially enable writing outside the intended destination directory...

(0Day) Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the getshareddriveobject method. The issue results from the lack of proper validati...

PT-2026-93833

Name of the Vulnerable Software and Affected Versions Airbyte OneDrive Connector affected versions not specified Description An issue exists in the get shared drive object function that allows remote authenticated attackers to initiate arbitrary server-side requests. This occurs due to insufficie...

SUSE CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

GO-2026-6101 Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials in github.com/cloudreve/Cloudreve

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials in github.com/cloudreve/Cloudreve. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...

PT-2026-80347

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials in github.com/cloudreve/Cloudreve. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...