Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
110 results · page 2 of 3
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42436 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information dCVE-2024-42435 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-42434 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-39825 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.5
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace Apps and Rooms Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39824 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39823 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informationCVE-2024-39822 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of serviceCVE-2024-39821 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace App for Windows and Zoom Rooms App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service CVE-2024-24693 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.2
Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Rooms Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via localCVE-2024-24692 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.3
Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Rooms Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.CVE-2023-49988 · Websites & servers · phpgurukul · reported by MITREHigh 7.5
Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.
- Product
- hotel_booking_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2023In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass.CVE-2023-40236 · Other software · Pexip · reported by MITREMedium 5.3
In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass.
- Product
- Virtual Meeting Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Nov 14, 2023Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local accCVE-2023-43591 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.8
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Rooms for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 14, 2023Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2023-43590 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.8
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Rooms for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 14, 2023Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclCVE-2023-39203 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Rooms Client for Windows and Zoom VDI Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 14, 2023Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.CVE-2023-39202 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 3.1
Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.
- Product
- Zoom Rooms Client for Windows and Zoom VDI Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Aug 8, 2023 Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.CVE-2023-39212 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.9
Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Aug 8, 2023Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an informatiCVE-2023-39211 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.8
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
- Product
- Zoom Desktop Client for Windows and Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jul 11, 2023Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.CVE-2023-36538 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.4
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jul 11, 2023Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local accCVE-2023-36537 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.3
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jul 11, 2023 Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege viCVE-2023-36536 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.2
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jul 11, 2023Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege vCVE-2023-34119 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.2
Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jul 11, 2023Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local accCVE-2023-34118 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.3
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially CVE-2023-34121 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.1
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
- Product
- Zoom for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 13, 2023Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to poCVE-2023-34120 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.7
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.
- Product
- Zoom for Windows Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Mar 16, 2023Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an iCVE-2023-22880 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.8
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.
- Product
- Zoom for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jan 9, 2023Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability.CVE-2022-36930 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jan 9, 2023The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability.CVE-2022-36929 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.8
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- Product
- Zoom Rooms for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jan 9, 2023Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability.CVE-2022-36927 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- Product
- Zoom Rooms for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jan 9, 2023Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability.CVE-2022-36926 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- Product
- Zoom Rooms for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jan 9, 2023Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism.CVE-2022-36925 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 4.4
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service.
- Product
- Zoom Rooms for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 17, 2022The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability.CVE-2022-36924 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- Product
- Zoom Rooms Installer for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Nov 17, 2022Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injectioCVE-2022-28766 · Other software · Zoom Video Communications Inc · reported by security@zoom.usLow 3.3
Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client.
- Product
- Zoom Client for Meetings for Windows (32-bit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Aug 17, 2022Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability.CVE-2022-28752 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
- Product
- Zoom Room for Conference Room for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jun 22, 2022In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality.CVE-2022-23055 · Other software · frappe · reported by vulnerabilitylab@mend.ioMedium 5.5
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view_room.php?id=.CVE-2022-32346 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view_room.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage_room.php?id=.CVE-2022-32345 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage_room.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check theCVE-2022-22786 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.5
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.
- Product
- Zoom Client for Meetings for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Apr 28, 2022The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft CVE-2022-22782 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.9
The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine.
- Product
- Zoom Client for Meetings for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Sep 27, 2021During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privCVE-2021-34411 · Other software · Zoom · reported by security@zoom.usHigh 7.8
During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privileges. If the installer was launched with elevated privileges such as by SCCM this can result in a local privilege escalation.
- Product
- Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Jan 31, 2020Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allowsCVE-2014-8338 · Other software · Videowhisper · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter.
- Product
- Webcam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
May 14, 2019The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php.CVE-2018-18800 · Other software · Tubigan · reported by MITRECritical 9.8
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php.
- Product
- Welcome TO OUR Resort
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jun 14, 2018In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.CVE-2018-12423 · Other software · Matrix · reported by MITREHigh 7.5
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
- Product
- Synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
May 2, 2018Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federaCVE-2018-10657 · Other software · Matrix · reported by MITREHigh 7.5
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.
- Product
- Synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2017IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id.CVE-2016-2966 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Oct 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HCVE-2014-5276 · Other software · Pro Chat Rooms · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via (1) an uploaded profile picture or (2) the edit parameter to profiles/index.php.
- Product
- Text Chat Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Oct 20, 2014Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SCVE-2014-5275 · Other software · Prochatrooms · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
- Product
- Text Chat Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Sep 19, 2014The ChatBox - Chat Rooms (aka com.droidchatroom.messengerapp) application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-CVE-2014-5958 · Other software · Chatbox · reported by cret@cert.orgMedium 5.4
The ChatBox - Chat Rooms (aka com.droidchatroom.messengerapp) application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Chatbox - Chat Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
May 26, 2014The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by lCVE-2013-3977 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comexchange.xforce.ibmcloud.com
Apr 28, 2014Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackersCVE-2014-2715 · Other software · Videowhisper · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php.
- Product
- Videowhisper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.