| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CVE-2023-21715 | Microsoft Office Publisher Security Feature Bypass Vulnerability | exploitation_technique | T1204.002 | Malicious File |
Comments
CVE-2023-21715 is a security feature bypass vulnerability exploitable when a user opens a specially-crafted file bypassing macro policies.
References
|
| CVE-2021-31207 | Microsoft Exchange Server Security Feature Bypass Vulnerability | primary_impact | T1565 | Data Manipulation |
Comments
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
References
|
| CVE-2021-31207 | Microsoft Exchange Server Security Feature Bypass Vulnerability | exploitation_technique | T1548.002 | Bypass User Account Control |
Comments
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
References
|
| CVE-2015-0310 | Adobe Flash Player ASLR Bypass Vulnerability | exploitation_technique | T1189 | Drive-by Compromise |
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | exploitation_technique | T1203 | Exploitation for Client Execution |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | primary_impact | T1105 | Ingress Tool Transfer |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | secondary_impact | T1562 | Impair Defenses |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | secondary_impact | T1106 | Native API |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | secondary_impact | T1059 | Command and Scripting Interpreter |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | secondary_impact | T1001 | Data Obfuscation |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-31201 | Apple Multiple Products Arbitrary Read and Write Vulnerability | secondary_impact | T1557 | Adversary-in-the-Middle |
Comments
A strategic zero-click iMessage exploit chain (CVE-2025-31200 / 31201) has been reported as compromising targeted devices with Paragon's Graphite spyware. Observed impacts include Secure Enclave key exfiltration, silent wallet theft, C2 infrastructure, and persistent C2 communication.
References
|
| CVE-2025-0411 | 7-Zip Mark of the Web Bypass Vulnerability | exploitation_technique | T1566.001 | Spearphishing Attachment |
Comments
Attackers can double-archive malicious payloads with 7-Zip to bypass Windows's Mark-of-the-Web security feature, further allowing the bypassing of Microsoft Defender SmartScreen. This allows attackers to disseminate these payloads via methods like email attachments, which would normally be subject to additional scrutiny by the service's protective measures. This flaw was patched in 7-Zip version 24.09.
References
|
| CVE-2025-0411 | 7-Zip Mark of the Web Bypass Vulnerability | exploitation_technique | T1553.005 | Mark-of-the-Web Bypass |
Comments
Attackers can double-archive malicious payloads with 7-Zip to bypass Windows's Mark-of-the-Web security feature, further allowing the bypassing of Microsoft Defender SmartScreen. This allows attackers to disseminate these payloads via methods like email attachments, which would normally be subject to additional scrutiny by the service's protective measures. This flaw was patched in 7-Zip version 24.09.
References
|
| CVE-2025-0411 | 7-Zip Mark of the Web Bypass Vulnerability | primary_impact | T1588.001 | Malware |
Comments
Attackers can double-archive malicious payloads with 7-Zip to bypass Windows's Mark-of-the-Web security feature, further allowing the bypassing of Microsoft Defender SmartScreen. This allows attackers to disseminate these payloads via methods like email attachments, which would normally be subject to additional scrutiny by the service's protective measures. This flaw was patched in 7-Zip version 24.09.
References
|
| CVE-2024-21413 | Microsoft Outlook Improper Input Validation Vulnerability | exploitation_technique | T1566.002 | Spearphishing Link |
Comments
Attackers can send a specially crafted email that uses the file:// protocol to reference a server that they own, ending the file:// link with an exclamation mark to bypass Outlook's security features, leading to remote code execution.
References
|
| CVE-2024-21413 | Microsoft Outlook Improper Input Validation Vulnerability | primary_impact | T1059 | Command and Scripting Interpreter |
Comments
Attackers can send a specially crafted email that uses the file:// protocol to reference a server that they own, ending the file:// link with an exclamation mark to bypass Outlook's security features, leading to remote code execution.
References
|