Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
474 results · page 4 of 10
Jan 30, 2025Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local accCVE-2025-0145 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.6
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.CVE-2025-0144 · Other software · Zoom Communications, Inc · reported by security@zoom.usLow 3.1
Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.CVE-2025-0143 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of CVE-2025-0142 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Jenkins Marketplace plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024phZoom: Cross-Site Request Forgery (CSRF)CVE-2024-54434 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.
- Product
- phZoom
- Affected
- up to 1.2.92
- What to do
- Affects up to 1.2.92. Update phZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024eRoom – Zoom Meetings & Webinar: Missing AuthorizationCVE-2022-43472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.
- Product
- eRoom – Zoom Meetings & Webinar
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update eRoom – Zoom Meetings & Webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Zooom: Stored Cross-Site ScriptingCVE-2024-11451 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zooom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zooom' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Zooom
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Zooom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 4, 2024ZOO-Project is a C-based WPS (Web Processing Service) implementation.CVE-2024-53982 · Other software · ZOO-Project · reported by GitHubHigh 8.7
ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024.
- Product
- ZOO-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Beaver Builder Addons by WPZOOM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM wpzoom-addons-for-beaver-builder allows Stored XSS.This issue affects Beaver Builder Addons by WPZOOM: from n/a through <= 1.3.4.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.CVE-2024-45422 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.CVE-2024-45420 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-45419 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024WM Zoom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50556 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WorldMarkerter WM Zoom wm-zoom allows DOM-Based XSS.This issue affects WM Zoom: from n/a through <= 1.0.
- Product
- WM Zoom
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WM Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2024When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentiCVE-2024-51504 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue.
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Nov 6, 2024Wp-ImageZoom: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2024-9934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Wp-ImageZoom
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Wp-ImageZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024Bamazoo – Button Generator: Stored Cross-Site ScriptingCVE-2024-10150 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bamazoo – Button Generator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Bamazoo – Button Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 16, 2024ZoomSounds: Arbitrary file uploadsCVE-2021-4449 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
- Product
- ZoomSounds
- Affected
- up to 5.96
- What to do
- Affects up to 5.96. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Sep 24, 2024WPZOOM Shortcodes: Stored Cross-Site ScriptingCVE-2024-9027 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Shortcodes
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WPZOOM Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 31, 2024WPZOOM Portfolio Lite – Filterable Portfolio: Stored Cross-Site ScriptingCVE-2024-8276 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Portfolio Lite – Filterable Portfolio
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WPZOOM Portfolio Lite – Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2024Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.CVE-2024-42441 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5CVE-2024-42440 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduCVE-2024-42439 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42438 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42437 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42436 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information dCVE-2024-42435 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-42434 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-39825 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.5
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace Apps and Rooms Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39824 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39823 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informationCVE-2024-39822 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.CVE-2024-39818 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.5
Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial CVE-2024-39827 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.5
Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace Desktop App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network acceCVE-2024-39826 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.8
Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of serviceCVE-2024-39821 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace App for Windows and Zoom Rooms App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a deCVE-2024-39820 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace Desktop App for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local aCVE-2024-39819 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.7
Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
- Product
- Zoom Workplace Apps and SDK for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27241 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.3
Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.CVE-2024-27240 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.1
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.
- Product
- Zoom Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation vCVE-2024-27238 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.1
Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.
- Product
- Zoom Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Beaver Builder Addons by WPZOOM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37464 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 20, 2024WPZOOM Addons for Elementor (Templates, Widgets): Stored Cross-Site ScriptingCVE-2024-5686 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.38
- What to do
- Affects up to 1.1.38. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2024Social Icons Widget & Block by WPZOOM: Missing AuthorizationCVE-2024-30464 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.
- Product
- Social Icons Widget & Block by WPZOOM
- Affected
- up to 4.2.15
- What to do
- Affects up to 4.2.15. Update Social Icons Widget & Block by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2024WPZOOM Addons for Elementor (Templates, Widgets): Local File InclusionCVE-2024-5147 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.37
- What to do
- Affects up to 1.1.37. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 21, 2024Social Icons Widget & Block by WPZOOM: Does not sanitise and escape some of its Widget settingsCVE-2024-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Icons Widget & Block by WPZOOM
- Fixed in
- 4.2.18
- What to do
- Update Social Icons Widget & Block by WPZOOM to 4.2.18 or newer.
May 15, 2024Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalationCVE-2024-27244 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.7
Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace VDI App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27243 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access.
- Product
- see references
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024WPZOOM Addons for Elementor (Templates, Widgets): Stored Cross-Site ScriptingCVE-2024-4370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.36
- What to do
- Affects up to 1.1.36. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024eRoom – Zoom Meetings & Webinars: Sensitive Information ExposureCVE-2024-3275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the search_posts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts including those of draft and pending posts.
- Product
- eRoom – Zoom Meetings & Webinars
- Affected
- up to 1.4.18
- What to do
- Affects up to 1.4.18. Update eRoom – Zoom Meetings & Webinars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 29, 2024Video Conferencing with Zoom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-33584 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with Zoom: from n/a through 4.4.4.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.