Luke Papandrea

**Name of the Vulnerable Software and Affected Versions** Microsoft 365 Copilot (affected versions not specified) **Description** This issue involves information disclosure within the Microsoft 365 Copilot BizChat feature. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Visio (affected versions not specified) Description: The issue is related to a lack of warning about dangerous actions in the Microsoft Office Visio graphic editor, which is part of Microsoft Office and Microsoft 365 Apps for Enterprise packages. Exploitation of this issue may allow an attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visio (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) **Description** The issue is related to errors in access control, allowing an attacker to execute arbitrary code if a user opens a specially crafted file. This can lead to remote code execution, potentially affecting the system. **Recommendations** For Microsoft Visio, consider avoiding the use of specially crafted files until a patch is available. For Microsoft Office, restrict access to potentially vulnerable components to minimize the risk of exploitation. For Microsoft 365 Apps for Enterprise, as a temporary workaround, consider disabling features that may be related to the vulnerability until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to incorrect handling of symbolic links before accessing a file, which can be exploited to execute arbitrary code. This allows an attacker to potentially affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to insufficient access restrictions in Microsoft Office, which can be exploited to elevate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to insufficient access restrictions in Microsoft Office, which can be exploited to elevate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visio (affected versions not specified) **Description** The issue is related to errors in security settings, allowing a remote attacker to bypass existing security restrictions. This can affect the system, but specific details about the number of potentially affected devices or real-world incidents are not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Project (affected versions not specified) **Description** A remote code execution issue exists in Microsoft Project software due to insufficient checking of the source markup of a file. This could allow a remote attacker to execute arbitrary code in the context of the current user. If the current user has administrative user rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Project. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.