CVE-2024-35205

The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aiming to overwrite an existing native library utilized by WPS Office. Successful exploitation could result in the execution of arbitrary commands under the guise of WPS Office's application ID.

• CWE-22

• https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-discovering-and-mitigating-a-common-vulnerability-pattern-in-android-apps/
• https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-discovering-and-mitigating-a-common-vulnerability-pattern-in-android-apps/

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3520The Country State City Dropdown CF7 plugin for WordPress is …4.3
• CVE-2024-35200When NGINX Plus or NGINX OSS are configured to use the HTTP/…5.3
• CVE-2024-35201Incorrect default permissions in the Intel(R) SDP Tool for W…7.8
• CVE-2024-35202Bitcoin Core before 25.0 allows remote attackers to cause a …7.5
• CVE-2024-35203Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-sit…6.1
• CVE-2024-35204Veritas System Recovery before 23.3_Hotfix has incorrect per…8.4
• CVE-2024-35206A vulnerability has been identified in SINEC Traffic Analyze…8.5
• CVE-2024-35207A vulnerability has been identified in SINEC Traffic Analyze…7.8
• CVE-2024-35208A vulnerability has been identified in SINEC Traffic Analyze…5.5
• CVE-2024-35209A vulnerability has been identified in SINEC Traffic Analyze…6.9
• CVE-2024-3521A vulnerability was found in Byzoro Smart S80 Management Pla…4.7
• CVE-2024-35210A vulnerability has been identified in SINEC Traffic Analyze…5.1