Exploiting Copilot AI for SharePoint

Comments (1)

nabla9 · 13h ago

Nutshell:

Copilot for SharePoint gets privileged access to SharePoint, but doesn’t know about access controls. CoPilot to just gives out out the contents of sensitive documents and the access won’t show up in audit logs.

Copilot for SharePoint is a SharePoint backdoor from Microsoft.

Plain Vanilla Web (plainvanillaweb.com)

From: Steve Jobs. "Great idea, thank you." (blog.hayman.net)

AlphaEvolve: A Gemini-powered coding agent for designing advanced algorithms (deepmind.google)

Void: Open-source Cursor alternative (github.com)

Mozilla Firefox – Official GitHub repo (github.com)

The world could run on older hardware if software optimization was a priority (twitter.com)

What is HDR, anyway? (lux.camera)

The Barbican (arslan.io)

Human (quarter--mile.com)

ALICE detects the conversion of lead into gold at the LHC (home.cern)

A critical look at MCP (raz.sh)

First American pope elected and will be known as Pope Leo XIV (cnn.com)

LegoGPT: Generating Physically Stable and Buildable Lego (avalovelace1.github.io)

Internet Artifacts (neal.fun)

Business books are entertainment, not strategic tools (theorthagonist.substack.com)

NSF faces shake-up as officials abolish its 37 divisions (science.org)

Leaving Google (airs.com)

I hacked a dating app (and how not to treat a security researcher) (alexschapiro.com)

Vision Now Available in Llama.cpp (github.com)

Ask HN: How are you acquiring your first hundred users?

Reservoir Sampling (samwho.dev)

A simple 16x16 dot animation from simple math rules (tixy.land)

One-Click RCE in Asus's Preinstalled Driver Software (mrbruh.com)

High tariffs become 'real' with our first $36K bill (blog.adafruit.com)

The great displacement is already well underway? (shawnfromportland.substack.com)

Embeddings are underrated (2024) (technicalwriting.dev)

Bus stops here: Shanghai lets riders design their own routes (sixthtone.com)

Car companies are in a billion-dollar software war (insideevs.com)

Observations from people-watching (skincontact.substack.com)

US Copyright Office found AI companies breach copyright. Its boss was fired (theregister.com)

Flattening Rust’s learning curve (corrode.dev)

Google is building its own DeX: First look at Android's Desktop Mode (androidauthority.com)

Writing that changed how I think about programming languages (bernsteinbear.com)

Rust’s dependencies are starting to worry me (vincents.dev)

Changes since congestion pricing started in New York (nytimes.com)

Branch Privilege Injection: Exploiting branch predictor race conditions (comsec.ethz.ch)

US vs. Google amicus curiae brief of Y Combinator in support of plaintiffs [pdf] (storage.courtlistener.com)

Multiple security issues in GNU Screen (openwall.com)

The recently lost file upload feature in the Nextcloud app for Android (nextcloud.com)

SMS 2FA is not just insecure, it's also hostile to mountain people (blog.stillgreenmoss.net)

A server that wasn't meant to exist (it-notes.dragas.net)

I built a native Windows Todo app in pure C (278 KB, no frameworks) (github.com)

Sofie: open-source web based system for automating live TV news production (nrkno.github.io)

Databricks acquires Neon (databricks.com)

Can you trust that permission pop-up on macOS? (wts.dev)

FastVLM: Efficient vision encoding for vision language models (github.com)

I ruined my vacation by reverse engineering WSC (blog.es3n1n.eu)

Writing an LLM from scratch, part 13 – attention heads are dumb (gilesthomas.com)

PDF to Text, a challenging problem (marginalia.nu)

LLMs get lost in multi-turn conversation (arxiv.org)

Exploiting Copilot AI for SharePoint

Comments (1)