Abankalarm

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) **Description** The issue is related to the use of an insecure search path in Microsoft Office and Microsoft 365 Apps for Enterprise packages. Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TruffleHog versions prior to 3.81.9 **Description** This issue allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. **Recommendations** For versions prior to 3.81.9, upgrade to TruffleHog v3.81.9 or a later version to mitigate the issue. As a temporary workaround, consider restricting access to unauthenticated GET endpoints that produce side effects until a patch is applied. Avoid scanning maliciously crafted data with specific detectors until the issue is resolved.