Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Microsoft Fixes Critical Office Bug, Delays MacOS Security Updates

Microsoft Fixes Critical Office Bug, Delays MacOS Security Updates

During this year’s first Patch Tuesday, Microsoft has addressed a critical severity Office vulnerability that can let attackers execute malicious code remotely on vulnerable systems.

The security flaw, tracked as CVE-2022-21840, is a remote code execution (RCE) bug that attackers can exploit with no privileges on the targeted devices as part of low complexity attacks that require user interaction.

“In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file,” Microsoft explains.

Also Read: 12 Damaging Consequences of Data Breach

“In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.”

To successfully exploit this critical vulnerability, attackers would have to trick their targets into opening a specially crafted Office document delivered using a link shared via instant messaging or email.

Luckily, Microsoft says that the Outlook preview pane cannot be used as an attack vector in exploitation attempts targeting this vulnerability.

However, it can be exploited via the Windows Explorer preview pane as confirmed by CERT/CC vulnerability analyst Will Dormann.

This implies that exploitation is possible without having to trick potential victims into opening maliciously crafted Office files but, instead, only having to select them in an Explorer window with the preview pane enabled.

macOS patches are still “under construction”

Even though Redmond has released security updates for Microsoft 365 Apps for Enterprise and Windows versions of Microsoft Office, the company is still working on patches addressing the vulnerability on macOS.

Mac users running Microsoft Office LTSC for Mac 2021 and Microsoft Office 2019 for Mac were told they would have to wait a little more to get CVE-2022-21840 patches.

“The security update for Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021 are not immediately available,” Microsoft says in today’s security advisory.

“The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.”

Also Read: Top 10 Main Reasons for Outsource Website Development

Microsoft has also failed to promptly release macOS patches for an actively exploited Excel zero-day in November, a severe security feature bypass bug that allows local exploitation from unauthenticated attackers in low complexity attacks that don’t require user interaction.

According to updates to the CVE info, Redmond issued security updates for the Microsoft Office for Mac zero-day one week later, advising users to deploy the patches for their product to be protected from in the wild attacks.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us