CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7263 – Arbitrary Code Execution in WPS Office
https://notcve.org/view.php?id=CVE-2024-7263
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough. Another hyperlink parameter was not properly sanitized which leads to the execution of an arbitrary Windows library. Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough. Another parameter was not properly sanitized which leads to the execution of an arbitrary Windows library. • https://www.wps.com/whatsnew/pc/20240422 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 0CVE-2024-7262 – Kingsoft WPS Office Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2024-7262
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. Using the MHTML format allows an attacker to automatically deliver a malicious library on opening the document and a single user click on a crafted hyperlink leads to the execution of the library. Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library. • https://www.wps.com/whatsnew/pc/20240422 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31275
https://notcve.org/view.php?id=CVE-2023-31275
An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability. Existe una vulnerabilidad de uso de puntero no inicializado en la funcionalidad de WPS Office 11.2.0.11537 que maneja elementos de datos en un archivo de Excel. Un archivo con formato incorrecto especialmente manipulado puede provocar la ejecución remota de código. • https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748 • CWE-457: Use of Uninitialized Variable CWE-908: Use of Uninitialized Resource •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32548
https://notcve.org/view.php?id=CVE-2023-32548
OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious server and sends a specially crafted data, an arbitrary OS command may be executed on the system where the product is installed. • https://jvn.jp/en/jp/JVN36060509 https://support.kingsoft.jp/about/20230605.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26081
https://notcve.org/view.php?id=CVE-2022-26081
The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer. El instalador de WPS Office versión 10.8.0.5745, carga de forma no segura de shcore.dll, lo que permite a un atacante ejecutar código arbitrario con el privilegio del usuario invocando a el instalador • https://jvn.jp/en/jp/JVN21234459 https://support.kingsoft.jp/support-info/weakness.html • CWE-427: Uncontrolled Search Path Element •