Metin Yunus Kandemir

Name of the Vulnerable Software and Affected Versions: Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) Description: The issue is related to insufficient protection of service data in Microsoft Office and Microsoft 365 Apps for Enterprise, allowing a remote attacker to conduct spoofing attacks. This can affect the system. Recommendations: For Microsoft Office, consider restricting access to sensitive features until a patch is available. For Microsoft 365 Apps for Enterprise, avoid using potentially vulnerable components until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an open redirect through HTML injection in user messages, allowing remote attackers to redirect targeted victims to any URL via the '<meta http-equiv="refresh">' in the WebSocket messages. This can be exploited by injecting malicious HTML code into user messages, enabling attackers to redirect users to arbitrary URLs. The estimated number of potentially affected devices worldwide is not specified.

The issue allows attackers to perform username enumeration via a crafted POST request to "/ServletAPI/accounts/login". This enables attackers to identify valid usernames, potentially leading to further attacks.

The issue allows NTLM Hash disclosure during certain storage-path configuration steps. This affects Zoho ManageEngine products, potentially leading to security breaches.

The issue exists due to the presence of a cross-site scripting (XSS) flaw. This flaw can be exploited by adding a branch under the Branches button and setting the `notes` parameter with crafted JavaScript code.

The issue concerns a problem where the `username` parameter in the User component has XSS.