Zoom vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-34416 The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting ConnecCritical 9.8 · Sep 27, 2021
• CVE-2021-34415 The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming nHigh 7.5 · Sep 27, 2021
• CVE-2021-34414 The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting ConnectorHigh 7.2 · Sep 27, 2021
• CVE-2021-34413 All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerability during the pluHigh 7.5 · Sep 27, 2021
• CVE-2021-34412 During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer.High 7.8 · Sep 27, 2021
• CVE-2021-34411 During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privHigh 7.8 · Sep 27, 2021
• CVE-2021-34410 A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows foHigh 7.8 · Sep 27, 2021
• CVE-2021-34408 The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged user during the instHigh 7.8 · Sep 27, 2021
• CVE-2021-33907 The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when perforCritical 9.8 · Sep 27, 2021
• CVE-2021-30480 Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction.High 8.5 · Apr 9, 2021
• CVE-2020-9767 A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which tHigh 7.8 · Aug 14, 2020
• CVE-2020-6110 An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets.High 8.8 · Jun 8, 2020
• CVE-2020-6109 An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs.Critical 9.8 · Jun 8, 2020
• CVE-2020-11443 The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version oHigh 8.1 · May 4, 2020
• CVE-2020-11877 airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption.High 7.5 · Apr 17, 2020
• CVE-2020-11876 airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context.High 7.5 · Apr 17, 2020
• CVE-2020-11500 Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption.High 7.5 · Apr 3, 2020
• CVE-2020-11469 Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (witHigh 7.8 · Apr 1, 2020
• CVE-2019-13567 The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450.High 8.8 · Jul 12, 2019
• CVE-2018-15715 Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthoCritical 9.8 · Nov 30, 2018
• CVE-2017-15049 The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allowHigh 8.8 · Dec 19, 2017
• CVE-2017-15048 Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by High 8.8 · Dec 19, 2017
• CVE-2004-0680 Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed forHigh 10 · Aug 6, 2004