Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391 results · page 3 of 8
Apr 8, 2025Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.CVE-2025-27441 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.6
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Arbitrary File ReadCVE-2025-3431 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 5, 2025ZoomSounds: Stored Cross-Site ScriptingCVE-2025-0839 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ZoomSounds
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13776 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 11, 2025Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2025-27440 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2025-27439 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2025-0151 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network accCVE-2025-0150 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.1
Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.CVE-2025-0149 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
- Product
- Zoom Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: PHP Object InjectionCVE-2024-13777 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Feb 25, 2025Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27246 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27245 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27239 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.CVE-2024-45426 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.9
Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.CVE-2024-45425 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.9
Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-45424 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.3
Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-45421 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.5
Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via nCVE-2024-45418 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.4
Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Apps for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of infoCVE-2024-45417 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6
Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access.
- Product
- Zoom Apps for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of informatioCVE-2025-0148 · Other software · Zoom Communications, Inc · reported by security@zoom.usLow 2.6
Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access.
- Product
- Zoom Jenkins Marketplace plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access.CVE-2025-0147 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 8.8
Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace App for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local accesCVE-2025-0146 · Other software · Zoom Communications, Inc · reported by security@zoom.usLow 3.9
Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace app for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local accCVE-2025-0145 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.6
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.CVE-2025-0144 · Other software · Zoom Communications, Inc · reported by security@zoom.usLow 3.1
Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.CVE-2025-0143 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of CVE-2025-0142 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Jenkins Marketplace plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024phZoom: Cross-Site Request Forgery (CSRF)CVE-2024-54434 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.
- Product
- phZoom
- Affected
- up to 1.2.92
- What to do
- Affects up to 1.2.92. Update phZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024eRoom – Zoom Meetings & Webinar: Missing AuthorizationCVE-2022-43472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.
- Product
- eRoom – Zoom Meetings & Webinar
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update eRoom – Zoom Meetings & Webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Beaver Builder Addons by WPZOOM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM wpzoom-addons-for-beaver-builder allows Stored XSS.This issue affects Beaver Builder Addons by WPZOOM: from n/a through <= 1.3.4.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.CVE-2024-45422 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.CVE-2024-45420 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-45419 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024WM Zoom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50556 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WorldMarkerter WM Zoom wm-zoom allows DOM-Based XSS.This issue affects WM Zoom: from n/a through <= 1.0.
- Product
- WM Zoom
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WM Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024Wp-ImageZoom: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2024-9934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Wp-ImageZoom
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Wp-ImageZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024ZoomSounds: Arbitrary file uploadsCVE-2021-4449 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
- Product
- ZoomSounds
- Affected
- up to 5.96
- What to do
- Affects up to 5.96. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Sep 24, 2024WPZOOM Shortcodes: Stored Cross-Site ScriptingCVE-2024-9027 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Shortcodes
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WPZOOM Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 31, 2024WPZOOM Portfolio Lite – Filterable Portfolio: Stored Cross-Site ScriptingCVE-2024-8276 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Portfolio Lite – Filterable Portfolio
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WPZOOM Portfolio Lite – Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2024Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.CVE-2024-42441 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5CVE-2024-42440 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduCVE-2024-42439 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42438 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42437 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42436 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information dCVE-2024-42435 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-42434 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-39825 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.5
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace Apps and Rooms Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39824 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39823 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informationCVE-2024-39822 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.CVE-2024-39818 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.5
Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.