{"vulnerability": "cve-2014-6352", "sightings": [{"uuid": "ff68a79e-5ea9-45d0-86b8-aea2879f08b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/544f6415-0364-486b-ac0e-4fe6950d210b", "content": "", "creation_timestamp": "2014-10-28T09:39:41.000000Z"}, {"uuid": "4a0c706e-cdd5-477f-8634-f5bf6ccdf0f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/54646762-aac0-4921-87b2-1c4a950d210b", "content": "", "creation_timestamp": "2014-11-13T08:13:18.000000Z"}, {"uuid": "827d7693-063b-4657-b73d-74858249ab63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/546ca820-87f8-4248-a6c0-952f950d210b", "content": "", "creation_timestamp": "2014-11-19T14:34:01.000000Z"}, {"uuid": "a8df40b0-3a3f-4581-959d-5af4055bb584", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/548ea354-bd2c-4db8-a984-400a950d210b", "content": "", "creation_timestamp": "2014-12-15T09:02:20.000000Z"}, {"uuid": "1bd95956-84b5-4d39-bc0d-4142eccf8b37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/36b8470b-ace9-416e-9994-ca272e4e6f1e", "content": "", "creation_timestamp": "2020-11-06T15:49:21.000000Z"}, {"uuid": "0fc1afb4-89ff-46bc-b7c5-9a4e6a258c86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/c100e80e-5a26-4a63-941c-6e7ac03114c1", "content": "", "creation_timestamp": "2020-10-09T14:26:46.000000Z"}, {"uuid": "b52e104a-63d2-4582-a302-424c28892ae0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/21b8cf94-f9f1-467a-9b17-5328dd7dcdf3", "content": "", "creation_timestamp": "2020-10-09T16:35:58.000000Z"}, {"uuid": "c0237916-275b-4e30-b30b-7d1de234a096", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/f1b31e3b-033e-4e0f-91b1-ac34f900a53f", "content": "", "creation_timestamp": "2020-10-09T14:10:16.000000Z"}, {"uuid": "13ce7e66-f9a5-4a2f-ba98-ae6899a79a6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/3eece7fb-11c4-4dc8-b867-fbdbf63b4ebd", "content": "", "creation_timestamp": "2020-10-09T17:15:36.000000Z"}, {"uuid": "7b43690e-4ac8-42df-a071-c8d131c5733c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/ccefe4b8-af5e-4483-9613-f9579dc29446", "content": "", "creation_timestamp": "2020-10-09T17:35:27.000000Z"}, {"uuid": "4ee8edf0-ea6c-4603-92e0-18681458ccf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/cc5c41b3-1c1e-4d6e-a546-c1a7718907a3", "content": "", "creation_timestamp": "2020-10-09T16:48:54.000000Z"}, {"uuid": "3a014fee-0a10-4ed0-be85-cf02cb365632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "37b1e443-9a96-4241-bd21-86bafbc815ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971264", "content": "", "creation_timestamp": "2024-12-24T20:26:42.875141Z"}, {"uuid": "6d78ee61-0fbf-4ab2-b6a6-a8c3f9e0aa96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "c193e0fd-81c0-409a-818a-09d7357b4016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:06.000000Z"}, {"uuid": "0a2b2432-b6c6-4e48-8adf-e6805e9a2e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:31.000000Z"}, {"uuid": "7e775a4b-1a82-428f-a404-4a5fd1f686f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_064_packager_python.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "0ea565e6-9cae-4952-866f-2a1ee8f957df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:43.000000Z"}, {"uuid": "907727d5-288b-486d-875b-a2b2b30ab8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:57.000000Z"}, {"uuid": "612b0f93-372b-47a9-8b7e-42a820a704e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_064_packager_run_as_admin.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "e2cf2d74-57d7-43ae-bc4d-4a4fcf787e0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2014-6352", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/61a8437c-8706-4895-a4f4-06f913e5b07a", "content": "", "creation_timestamp": "2026-02-02T12:28:22.414081Z"}, {"uuid": "076f9538-798f-4472-a5a3-1f40777fbfab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-6352", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/35235", "content": "", "creation_timestamp": "2014-11-14T00:00:00.000000Z"}, {"uuid": "ae75f130-2fbd-415e-be41-c9291a58b58a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-6352", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/35236", "content": "", "creation_timestamp": "2014-11-14T00:00:00.000000Z"}, {"uuid": "712820f4-2e1e-4d52-bc04-914bb2db9563", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-6352", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/35020", "content": "", "creation_timestamp": "2014-10-20T00:00:00.000000Z"}, {"uuid": "d9893ce1-455d-46ae-8239-c72c61370cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "published-proof-of-concept", "source": "https://t.me/Pen7esting/209", "content": "[PoC] 2010~2018 MS Office 0-day/1-day exploit-case-study#OpenXMLTag#RTF#ActiveX#UAF#TIFF#EPS#Moniker\n\nCVE-2010-3333\nCVE-2014-1761\nCVE-2016-7193\nCVE-2015-1641\nCVE-2017-11826\nCVE-2012-0158\nCVE-2012-1856\nCVE-2015-1642\nCVE-2014-6352\nCVE-2015-0097https://t.co/MHJ5xtGSKZ\u2014 Jin Wook (@wugeej) June 14, 2019", "creation_timestamp": "2019-06-18T06:53:33.000000Z"}, {"uuid": "70607fa7-f729-4fcb-80e0-ddfb5c19c678", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "exploited", "source": "https://t.me/arpsyndicate/1281", "content": "#ExploitObserverAlert\n\nCVE-2014-6352\n\nDESCRIPTION: Exploit Observer has 14 entries related to CVE-2014-6352. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.\n\nFIRST-EPSS: 0.969110000\nNVD-IS: 10.0\nNVD-ES: 8.6", "creation_timestamp": "2023-12-04T19:05:38.000000Z"}, {"uuid": "022fa93c-ad9b-4d34-a229-d9329dbf763a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJ_k2WzpXql3KPPBgA", "content": "", "creation_timestamp": "2026-08-01T12:00:06.796006Z"}, {"uuid": "4d2c2acb-da6b-4d4b-9192-c6b9e775a71b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJ_k2WzpXql3KPPBgA", "content": "", "creation_timestamp": "2026-08-02T00:00:48.639301Z"}, {"uuid": "2a72a700-1a5d-4f35-9463-b2ede20aaf88", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2c4c3099-11a1-4b29-a6f0-371ab502b18a", "content": "", "creation_timestamp": "2026-06-19T12:47:37.401359Z"}, {"uuid": "8e0c8cb9-8a76-40bb-89ea-31f232bf82ac", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0714e7b3-f0eb-4adf-ac3a-c3d18cfac936", "content": "", "creation_timestamp": "2026-06-23T14:04:57.855266Z"}, {"uuid": "61e9de60-f93e-4ef0-ac2e-dd7901a06375", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://t.me/pleyades_it/5749", "content": "\ud83c\uddf2\ud83c\uddfe Malasia ha advertido de la sucesi\u00f3n de varios ciberataques a funcionarios de su gobierno y se\u00f1alan como responsables al grupo de crackers chinos APT40. El comunicado ha sido emitido por el Equipo de Respuesta ante Emergencias Inform\u00e1ticas (MyCERT) de Malasia.\nEl objetivo de los ciberataques ha sido infectar los equipos de los funcionarios gubernamentales con malware para luego robar documentos confidenciales.\nSeg\u00fan MyCERT, la metodolog\u00eda de los ataques consist\u00eda en el phishing dirigido (spear phising); los crackers enviaban correos maliciosos a los funcionarios fingiendo ser periodistas o representantes de ONG's, asociaciones militares o de publicaciones comerciales. Esos correos conten\u00edan enlaces a documentos almacenados en Google Drive. Al abrir los documentos, estos ped\u00edan al usuario habilitar las macros y entonces una macro maliciosa explotaba dos vulnerabilidades de Microsoft Office (CVE-2014-6352 y CVE-2017-0199) para descargar e instalar el malware en el equipo de la v\u00edctima.\nhttp://pygy.co/CgP\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\nM\u00e1s sobre el spear phishing: http://pygy.co/CgR\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\nWeb de MyCERT: https://www.mycert.org.my/\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796", "creation_timestamp": "2026-07-12T22:00:18.569847Z"}, {"uuid": "c0b5a16f-1b79-4dbf-aff6-065e0693439e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://t.me/pleyades_it/5749", "content": "\ud83c\uddf2\ud83c\uddfe Malasia ha advertido de la sucesi\u00f3n de varios ciberataques a funcionarios de su gobierno y se\u00f1alan como responsables al grupo de crackers chinos APT40. El comunicado ha sido emitido por el Equipo de Respuesta ante Emergencias Inform\u00e1ticas (MyCERT) de Malasia.\nEl objetivo de los ciberataques ha sido infectar los equipos de los funcionarios gubernamentales con malware para luego robar documentos confidenciales.\nSeg\u00fan MyCERT, la metodolog\u00eda de los ataques consist\u00eda en el phishing dirigido (spear phising); los crackers enviaban correos maliciosos a los funcionarios fingiendo ser periodistas o representantes de ONG's, asociaciones militares o de publicaciones comerciales. Esos correos conten\u00edan enlaces a documentos almacenados en Google Drive. Al abrir los documentos, estos ped\u00edan al usuario habilitar las macros y entonces una macro maliciosa explotaba dos vulnerabilidades de Microsoft Office (CVE-2014-6352 y CVE-2017-0199) para descargar e instalar el malware en el equipo de la v\u00edctima.\nhttp://pygy.co/CgP\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\nM\u00e1s sobre el spear phishing: http://pygy.co/CgR\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\nWeb de MyCERT: https://www.mycert.org.my/\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796", "creation_timestamp": "2026-07-13T00:00:42.219414Z"}, {"uuid": "a727bd99-8fd6-4179-aba8-36b532c04fe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "published-proof-of-concept", "source": "https://t.me/pleyades_it/5749", "content": "\ud83c\uddf2\ud83c\uddfe Malasia ha advertido de la sucesi\u00f3n de varios ciberataques a funcionarios de su gobierno y se\u00f1alan como responsables al grupo de crackers chinos APT40. El comunicado ha sido emitido por el Equipo de Respuesta ante Emergencias Inform\u00e1ticas (MyCERT) de Malasia.\nEl objetivo de los ciberataques ha sido infectar los equipos de los funcionarios gubernamentales con malware para luego robar documentos confidenciales.\nSeg\u00fan MyCERT, la metodolog\u00eda de los ataques consist\u00eda en el phishing dirigido (spear phising); los crackers enviaban correos maliciosos a los funcionarios fingiendo ser periodistas o representantes de ONG's, asociaciones militares o de publicaciones comerciales. Esos correos conten\u00edan enlaces a documentos almacenados en Google Drive. Al abrir los documentos, estos ped\u00edan al usuario habilitar las macros y entonces una macro maliciosa explotaba dos vulnerabilidades de Microsoft Office (CVE-2014-6352 y CVE-2017-0199) para descargar e instalar el malware en el equipo de la v\u00edctima.\nhttp://pygy.co/CgP\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\nM\u00e1s sobre el spear phishing: http://pygy.co/CgR\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\nWeb de MyCERT: https://www.mycert.org.my/\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796", "creation_timestamp": "2026-07-14T00:00:48.713732Z"}, {"uuid": "64568484-252e-4d3e-b90e-2f624ac3c546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJ_k2WzpXql3KPPBgA", "content": "", "creation_timestamp": "2026-07-29T12:01:37.726215Z"}, {"uuid": "bc918b70-9f93-488d-9d14-f9beac8355a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJ_k2WzpXql3KPPBgA", "content": "", "creation_timestamp": "2026-07-30T00:01:59.146234Z"}, {"uuid": "413ab269-3066-4df3-991a-cebfe39884c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_064_packager_python.rb", "content": "{\"aliases\": [], \"arch\": \"python\", \"author\": [\"Haifei Li\", \"sinn3r \", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE)\\n          allowing arbitrary code execution, bypassing the patch MS14-060, for the vulnerability\\n          publicly known as \\\"Sandworm\\\", on systems with Python for Windows installed. Windows Vista\\n          SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable.\\n          However, based on our testing, the most reliable setup is on Windows platforms running\\n          Office 2013 and Office 2010 SP2. Please keep in mind that some other setups such as\\n          those using Office 2010 SP1 may be less stable, and may end up with a crash due to a\\n          failure in the CPackage::CreateTempFileName function.\", \"disclosure_date\": \"2014-11-12\", \"fullname\": \"exploit/windows/fileformat/ms14_064_packager_python\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/ms14_064_packager_python.rb\", \"platform\": \"Python\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/fileformat/ms14_064_packager_python\", \"references\": [\"CVE-2014-6352\", \"MSB-MS14-064\", \"BID-70690\", \"URL-http://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-for-the-sandworm-zero-day-even-editing-can-cause-harm\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows 7 SP1 with Python for Windows / Office 2010 SP2 / Office 2013\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:28.717278Z"}, {"uuid": "e6828d1f-162a-4821-9f92-2b3b0f847375", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6352", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_064_packager_run_as_admin.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"Haifei Li\", \"sinn3r \", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE)\\n          allowing arbitrary code execution, publicly exploited in the wild as MS14-060 patch bypass.\\n          The Microsoft update tried to fix the vulnerability publicly known as \\\"Sandworm\\\". Platforms\\n          such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known\\n          to be vulnerable. However, based on our testing, the most reliable setup is on Windows\\n          platforms running Office 2013 and Office 2010 SP2. Please keep in mind that some other\\n          setups such as using Office 2010 SP1 might be less stable, and may end up with a\\n          crash due to a failure in the CPackage::CreateTempFileName function.\", \"disclosure_date\": \"2014-10-21\", \"fullname\": \"exploit/windows/fileformat/ms14_064_packager_run_as_admin\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"MS14-064 Microsoft Windows OLE Package Manager Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/ms14_064_packager_run_as_admin.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/fileformat/ms14_064_packager_run_as_admin\", \"references\": [\"CVE-2014-6352\", \"MSB-MS14-064\", \"BID-70690\", \"URL-http://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-sandworm-zero-day-even-editing-dangerous\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows 7 SP1 / Office 2010 SP2 / Office 2013\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:28.795999Z"}]}