WordPress plugin WPS Telegram Chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39728 · WordPress · Wps Telegram Chat

Name of the Vulnerable Software and Affected Versions: WPS Telegram Chat plugin for WordPress versions up to, and including, 4.5.4 Description: The issue allows authenticated attackers with subscriber-level access and above to have full access to the Telegram Bot API endpoint and communicate with...

WordPress plugin WPS Telegram Chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WPS Telegram Chat plugin <= 4.5.4 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API vulnerability

Authenticated Subscriber+ Unauthorized Access to Telegram Bot API vulnerability discovered by István Márton in WordPress Plugin WPS Telegram Chat versions = 4.5.4...

WordPress WPS Telegram Chat Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software WPS Telegram Chat Type Plugin Vulnerable versions = 4.5.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9630 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9cb16fad33b1 Credits István Márton Required privile...

WordPress WPS Telegram Chat Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software WPS Telegram Chat Type Plugin Vulnerable versions = 4.5.4 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Access Control CVE CVE-2024-9628 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 35d166ea4c51 Credits...

The vulnerability of the MHTML export function in the Spreadsheet module of the WPS Office office software for Windows operating systems allows a malicious individual to perform arbitrary commands.

The vulnerability of the MHTML export function in the Spreadsheet module of the WPS Office office software on Windows operating systems is related to the loading of malicious DLL libraries due to an incorrect limitation on the path to the ksoqing directory. Exploiting this vulnerability allows a...

JVN#32529796: Multiple products from KINGSOFT JAPAN vulnerable to path traversal

KINGSOFT JAPAN, INC. provides Kingsoft Office Software's WPS Office and its related products localized for Japan. WPS Office and its related products provided by KINGSOFT JAPAN, INC. contain a path traversal vulnerability CWE-22, CVE-2024-7262, CVE-2024-7263 due to inadequate file path validation...

Kingsoft WPS Office Installed (Windows)

Binary data kingsoftwpsofficewininstalled.nbin...

Kingsoft WPS Office 12.2.0.13110 < 12.2.0.17119 Arbitrary Code Execution (CVE-2024-7263)

The version of Kingsoft WPS Office installed on the remote Windows host is at least 12.2.0.13110 and prior to 12.2.0.17119. It is, therefore, affected by an arbitrary code execution vulnerability: - Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from...

Kingsoft WPS Office 12.2.0.13110 < 12.2.0.16412 Arbitrary Code Execution (CVE-2024-7262)

The version of Kingsoft WPS Office installed on the remote Windows host is at least 12.2.0.13110 and prior to 12.2.0.16412. It is, therefore, affected by an arbitrary code execution vulnerability: - Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from...

Kingsoft WPS Office Path Traversal Vulnerability

Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library...

WordPress WPS Hide Login Login Page Revealer

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress WPS Hide Login Login Page Revealer', 'Description' = %q This module exploits a bypass issue with WPS Hide Login version 'WPVDB',...

APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor

A South Korea-aligned cyber espionage has been linked to the zero-day exploitation of a now-patched critical remote code execution flaw in Kingsoft WPS Office to deploy a bespoke backdoor dubbed SpyGlace. The activity has been attributed to a threat actor dubbed APT-C-60, according to cybersecuri...

PT-2024-39993 · Kingsoft · Wps Office

Name of the Vulnerable Software and Affected Versions: WPS Office affected versions not specified Description: The issue concerns arbitrary code execution vulnerabilities. A cyberespionage group, APT-C-60, aligned with South Korea, has been identified. Recommendations: At the moment, there is no...

CVE-2024-7263

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 exclusive on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough...

CVE-2024-7262

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 exclusive on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive...

CVE-2024-7262

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 exclusive on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive...

CVE-2024-7263

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 exclusive on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough...

CVE-2024-7263 Arbitrary Code Execution in WPS Office

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 exclusive on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough...