Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391 results · page 4 of 8
Jul 15, 2024Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial CVE-2024-39827 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.5
Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace Desktop App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network acceCVE-2024-39826 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.8
Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.
- Product
- Zoom Workplace Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of serviceCVE-2024-39821 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace App for Windows and Zoom Rooms App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a deCVE-2024-39820 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace Desktop App for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local aCVE-2024-39819 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.7
Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
- Product
- Zoom Workplace Apps and SDK for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27241 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.3
Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.CVE-2024-27240 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.1
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.
- Product
- Zoom Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation vCVE-2024-27238 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.1
Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.
- Product
- Zoom Apps and SDKs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Beaver Builder Addons by WPZOOM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37464 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 20, 2024WPZOOM Addons for Elementor (Templates, Widgets): Stored Cross-Site ScriptingCVE-2024-5686 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.38
- What to do
- Affects up to 1.1.38. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2024Social Icons Widget & Block by WPZOOM: Missing AuthorizationCVE-2024-30464 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.
- Product
- Social Icons Widget & Block by WPZOOM
- Affected
- up to 4.2.15
- What to do
- Affects up to 4.2.15. Update Social Icons Widget & Block by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2024WPZOOM Addons for Elementor (Templates, Widgets): Local File InclusionCVE-2024-5147 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.37
- What to do
- Affects up to 1.1.37. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 21, 2024Social Icons Widget & Block by WPZOOM: Does not sanitise and escape some of its Widget settingsCVE-2024-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Icons Widget & Block by WPZOOM
- Fixed in
- 4.2.18
- What to do
- Update Social Icons Widget & Block by WPZOOM to 4.2.18 or newer.
May 15, 2024Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalationCVE-2024-27244 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.7
Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace VDI App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27243 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access.
- Product
- see references
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024WPZOOM Addons for Elementor (Templates, Widgets): Stored Cross-Site ScriptingCVE-2024-4370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.36
- What to do
- Affects up to 1.1.36. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024eRoom – Zoom Meetings & Webinars: Sensitive Information ExposureCVE-2024-3275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the search_posts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts including those of draft and pending posts.
- Product
- eRoom – Zoom Meetings & Webinars
- Affected
- up to 1.4.18
- What to do
- Affects up to 1.4.18. Update eRoom – Zoom Meetings & Webinars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 29, 2024Video Conferencing with Zoom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-33584 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with Zoom: from n/a through 4.4.4.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024WPZOOM Addons for Elementor (Templates, Widgets): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35.
- Product
- WPZOOM Addons for Elementor (Templates, Widgets)
- Affected
- up to 1.1.35
- What to do
- Affects up to 1.1.35. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024Appointment Bookings for Zoom GoogleMeet and more – Wappointment: Server-Side Request Forgery (SSRF)CVE-2024-32454 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0.
- Product
- Appointment Bookings for Zoom GoogleMeet and more – Wappointment
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Appointment Bookings for Zoom GoogleMeet and more – Wappointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 13, 2024WPZOOM Social Feed Widget & Block: Unauthorized accessCVE-2024-3662 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site.
- Product
- WPZOOM Social Feed Widget & Block
- Affected
- up to 2.1.13
- What to do
- Affects up to 2.1.13. Update WPZOOM Social Feed Widget & Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Beaver Builder Addons by WPZOOM: Stored Cross-Site ScriptingCVE-2024-2187 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Beaver Builder Addons by WPZOOM: Stored Cross-Site ScriptingCVE-2024-2186 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Beaver Builder Addons by WPZOOM: Stored Cross-Site ScriptingCVE-2024-2185 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Beaver Builder Addons by WPZOOM: Stored Cross-Site ScriptingCVE-2024-2183 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-30424 is likely a duplicate of this issue.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Beaver Builder Addons by WPZOOM: Stored Cross-Site ScriptingCVE-2024-2181 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Beaver Builder Addons by WPZOOM
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Video Conferencing with Zoom: Sensitive Information ExposureCVE-2024-2033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of all users on a site.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of CVE-2024-27247 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.5
Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Desktop Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Cross site scripting in Zoom Desktop Client for Linux before version 5.17.10 may allow an authenticated user to conduct a denial of service via network access.CVE-2024-27242 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.1
Cross site scripting in Zoom Desktop Client for Linux before version 5.17.10 may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Desktop Client for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalatiCVE-2024-24694 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.9
Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Desktop Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service CVE-2024-24693 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.2
Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Rooms Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via localCVE-2024-24692 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.3
Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Rooms Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024Video Conferencing with Zoom: Stored Cross-Site ScriptingCVE-2024-2031 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2024Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.CVE-2024-24699 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.5
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.CVE-2024-24698 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.9
Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2024-24697 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.2
Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to cCVE-2024-24696 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.8
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to cCVE-2024-24695 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.8
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user toCVE-2024-24691 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usCritical 9.6
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access.CVE-2024-24690 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.4
Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024WPZOOM Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22162 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.3.
- Product
- WPZOOM Shortcodes
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WPZOOM Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2024Image Zoom: Missing AuthorizationCVE-2022-41619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.
- Product
- Image Zoom
- Affected
- up to 1.8.8
- What to do
- Affects up to 1.8.8. Update Image Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 12, 2024Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticCVE-2023-49647 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.8
Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privilegeCVE-2023-50027 · Other software · Buy-addons · reported by MITRECritical 9.8
SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.
- Product
- Bazoom Magnifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
- Product
- Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
- Affected
- up to 3.05.0
- What to do
- Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Deserialization of Untrusted DataCVE-2023-51422 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
- Product
- Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
- Affected
- up to 3.05.0
- What to do
- Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 13, 2023Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access.CVE-2023-49646 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.4
Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalatiCVE-2023-43586 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.3
Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Desktop Client for Windows, Zoom VDI Client for Windows and Zoom SDKs for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of informCVE-2023-43585 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.1
Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Mobile App for iOS and SDKs for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user tCVE-2023-43583 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.9
Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access.
- Product
- Zoom Mobile App for Android, Zoom Mobile App for iOS and Zoom SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.