Hidetake Jo

The issue is a security feature bypass vulnerability in Microsoft Office Publisher. It has been found exploited in the wild, affecting Microsoft products. There is no information provided about the estimated number of potentially affected devices worldwide or specific technical details about exploitation, such as API endpoints, vulnerable parameters, or function names.

The issue exists due to insufficient input validation in the Windows Shell component of the Windows operating system. This allows a remote attacker to execute arbitrary code in the context of the current user by using a specially crafted file. The vulnerability can be exploited by remote attackers to execute arbitrary code and affect the system.

A cross-site scripting (XSS) issue allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted text/plain file. This could potentially lead to unauthorized actions on a user's session.

The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted `dialogArguments` values. This is due to improper restriction of read access to object properties in `showModalDialog`.