Eiji James Yoshida

O problema está relacionado ao caminho de busca de DLLs no instalador, o que pode levar ao carregamento inseguro de bibliotecas de ligação dinâmica (DLLs). Isso foi relatado em uma versão do produto que chegou ao fim do ciclo de vida.

O problema está relacionado ao carregamento inseguro da biblioteca d3dx9 41.dll ao abrir arquivos .pps, especificamente devido ao carregamento da DLL no “tipo de diretório atual”. Isso pode permitir que um invasor eleve privilégios e execute código arbitrário.

O problema está relacionado ao carregamento inseguro da biblioteca dinâmica `shcore.dll` pelo instalador do WPS Office, permitindo que um invasor execute código arbitrário com os privilégios do usuário que invocou o instalador. Isso pode potencialmente levar à escalada de privilégios e à execução de código malicioso.

The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of `msjet49.dll` loaded by the vulnerable products.

The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of `ykkapi.dll` loaded by the vulnerable products.

The issue concerns an untrusted search path vulnerability in the installer. This vulnerability allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

The issue allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory due to an untrusted search path vulnerability.

The issue allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability in the installers for the affected software.

The issue concerns an untrusted search path vulnerability in the Vivaldi installer for Windows. This vulnerability allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000, XP, and Server 2003 Description: A cross-site scripting issue exists due to the Indexing Service in Microsoft Windows. When the Encoding option is set to Auto Select, remote attackers can inject arbitrary web script or HTML via a UTF-7 encoded URL. This encoded URL is then injected into an error message with a charset set to UTF-7. Recommendations: For Microsoft Windows 2000, XP, and Server 2003, consider disabling the Indexing Service or setting the Encoding option to a value other than Auto Select to mitigate the risk of exploitation. Restrict access to the Indexing Service to minimize the risk of remote attackers injecting arbitrary web script or HTML.

A directory traversal issue exists in the "Shell Folders" capability, allowing remote attackers to read arbitrary files by utilizing .. (dot dot) sequences in a "shell:" link.