CVSS: 9.3EPSS: 93%CPEs: 4EXPL: 0CVE-2010-2573 – Microsoft Office PowerPoint Unknown Animation Node Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-2573
Integer underflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3, PowerPoint Viewer SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Integer Underflow Causes Heap Corruption Vulnerability." Desbordamiento de entero en Microsoft PowerPoint 2002 SP3 y 2003 SP3, PowerPoint Viewer SP2, y Office 2004 para Mac permite a atacantes remotos ejecutar código de su elección a través de un documento PowerPoint manipulado, también conocida como "Vulnerabilidad de desbordamiento de entero en PowerPoint causeante de corrupción de pila" This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Powerpoint 2003. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the application trusting a value defined within a file. This value will have some arithmetic performed on it, and subsequently be used as a counter for a processing loop. By modifying this value, an attacker can reliably corrupt memory. • http://www.us-cert.gov/cas/techalerts/TA10-313A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-088 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12122 • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 3CVE-2010-3141 – Microsoft PowerPoint 2007 - 'rpawinet.dll' DLL Hijacking
https://notcve.org/view.php?id=CVE-2010-3141
Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse pptimpconv.dll that is located in the same folder as a .odp, .pot, .potm, .potx, .ppa, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .pwz, .sldm, or .sldx file. Una vulnerabilidad de ruta de búsqueda no confiable en Microsoft PowerPoint 2010 permite a los usuarios locales, y posiblemente a los atacantes remotos, ejecutar código arbitrario y conducir ataques de secuestro de DLL por medio de un troyano pptimpconv.dll que esta ubicado en la misma carpeta que un archivo .odp, .pot, .potm , .potx, .ppa, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .pwz, .sldm o .sldx. • https://www.exploit-db.com/exploits/14782 https://www.exploit-db.com/exploits/14723 http://www.exploit-db.com/exploits/14723 •
CVSS: 9.3EPSS: 79%CPEs: 1EXPL: 3CVE-2010-3142 – Microsoft PowerPoint 2007 - 'rpawinet.dll' DLL Hijacking
https://notcve.org/view.php?id=CVE-2010-3142
Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse rpawinet.dll that is located in the same folder as a .odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx file. Vulnerabilidad de ruta de búsqueda no confiable en Microsoft Office PowerPoint 2007 permite a usuarios locales, y puede que atacantes remotos, ejecutar código de su elección y producir un ataque de secuestro de DLL, a través de un troyano rpawinet.dll que está ubicado en la misma carpeta que un fichero .odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, o .thmx • https://www.exploit-db.com/exploits/14782 https://www.exploit-db.com/exploits/14723 http://www.exploit-db.com/exploits/14782 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12219 •
CVSS: 9.3EPSS: 75%CPEs: 2EXPL: 0CVE-2010-0030
https://notcve.org/view.php?id=CVE-2010-0030
Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint LinkedSlideAtom Heap Overflow Vulnerability." Desbordamiento de búfer basado en pila en Microsoft Office PowerPoint 2002 SP3 y 2003 SP3, permite a atacantes remotos ejecutar código de su elección a través de un documento PowerPoint manipulado. También se conoce como "Vulnerabilidad de Desbordamiento de Pila de PowerPoint LinkedSlideAtom" • http://www.securitytracker.com/id?1023563 http://www.us-cert.gov/cas/techalerts/TA10-040A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-004 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8050 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 65%CPEs: 2EXPL: 0CVE-2010-0032
https://notcve.org/view.php?id=CVE-2010-0032
Use-after-free vulnerability in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "OEPlaceholderAtom Use After Free Vulnerability." Vulnerabilidad de uso después de la liberación en Microsoft Office PowerPoint 2002 SP3 y 2003 SP3, permite a atacantes remotos ejecutar código de su elección a través de un documento Power Point manipulado. También se conoce como "Vulnerabilidad de uso después de la liberación OEPlaceholderAtom" • http://www.securitytracker.com/id?1023563 http://www.us-cert.gov/cas/techalerts/TA10-040A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-004 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8303 • CWE-94: Improper Control of Generation of Code ('Code Injection') •