Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

602 results · page 4 of 13

Jun 13, 2023Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potentially enable a denial of service via locCVE-2023-34115 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potentially enable a denial of service via local access. This issue may result in the Zoom Meeting SDK to crash and need to be restarted.
Product
Zoom Meeting SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially CVE-2023-34121 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.1
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
Product
Zoom for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability.CVE-2023-28603 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.7
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
Product
Zoom VDI Windows Meeting Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
May 12, 2023An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: ApacheCVE-2023-29246 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.2
An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Product
Apache OpenMeetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
May 12, 2023An attacker that has gained access to certain private information can use this to act as other user.CVE-2023-29032 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0
Product
Apache OpenMeetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
May 12, 2023Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 CVE-2023-28936 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Product
Apache OpenMeetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Apr 5, 2023Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSCVE-2023-20134 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack or upload arbitrary files as recordings. For more information about these vulnerabilities, see the Details section of this advisory.
Product
Cisco Webex Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Apr 5, 2023Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSCVE-2023-20132 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack or upload arbitrary files as recordings. For more information about these vulnerabilities, see the Details section of this advisory.
Product
Cisco Webex Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Mar 28, 2023Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in anCVE-2023-28326 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
Product
Apache OpenMeetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Mar 27, 2023Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability.CVE-2023-28596 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.8
Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
Product
Zoom Client for Meetings for IT Admin macOS installers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 16, 2023Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability.CVE-2023-22883 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.2
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to the SYSTEM user.
Product
Zoom Client for Meetings for IT Admin Windows installers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Feb 10, 2023 Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component.CVE-2022-34389 · Other software · Dell · reported by security_alert@emc.comLow 3.7
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician.
Product
SupportAssist
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Dec 2, 2022webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php.CVE-2022-44959 · Other software · Webtareas Project · reported by MITREMedium 5.4
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Product
Webtareas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 17, 2022The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability.CVE-2022-28768 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to root.
Product
Zoom Client for Meetings Installer for macOS (Standard and for IT Admin)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 17, 2022Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injectioCVE-2022-28766 · Other software · Zoom Video Communications Inc · reported by security@zoom.usLow 3.3
Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client.
Product
Zoom Client for Meetings for Windows (32-bit)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2022The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability.CVE-2022-28764 · Other software · Zoom Video Communications Inc · reported by security@zoom.usLow 3.3
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting that database results in a local malicious user being able to obtain meeting information such as in-meeting chat for the previous meeting attended from that local user account.
Product
Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Oct 31, 2022The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability.CVE-2022-28763 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers.
Product
Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Oct 14, 2022Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration.CVE-2022-28762 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.3
Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the Zoom Apps running in the Zoom client.
Product
Zoom Client for Meetings for MacOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Oct 14, 2022Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability.CVE-2022-28761 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and video causing meeting disruptions.
Product
Zoom On-Premise Meeting Connector MMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Oct 14, 2022Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability.CVE-2022-28760 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
Product
Zoom On-Premise Meeting Connector MMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Oct 14, 2022Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability.CVE-2022-28759 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.2
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
Product
Zoom On-Premise Meeting Connector MMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Sep 28, 2022BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.CVE-2020-27602 · Other software · Bigbluebutton · reported by MITRECritical 9.8
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
Product
Bigbluebutton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.CVE-2022-37339 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 16, 2022Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability.CVE-2022-28758 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.2
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
Product
Zoom On-Premise Meeting Connector MMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Sep 8, 2022A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or otheCVE-2022-20863 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks.
Product
Cisco Webex Meetings Desktop App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Aug 30, 2022OAKlouds Portal website’s Meeting Room has insufficient validation for user input.CVE-2022-38118 · Other software · HGiga · reported by twcert@cert.org.twHigh 8.8
OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.
Product
OAKlouds
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chtsecurity.com twcert.org.tw
Aug 18, 2022The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update proCVE-2022-28757 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
Product
Zoom Client for Meetings for MacOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 17, 2022The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during theCVE-2022-28751 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
Product
Zoom Client for Meetings for MacOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 15, 2022The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update proCVE-2022-28756 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.8
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
Product
Zoom Client for Meetings for MacOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 11, 2022The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability.CVE-2022-28755 · Other software · Zoom Video Communications Inc · reported by security@zoom.usCritical 9.6
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.
Product
Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 11, 2022Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability.CVE-2022-28754 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.1
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.
Product
Zoom On-Premise Meeting Connector MMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 11, 2022Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability.CVE-2022-28753 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.1
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.
Product
Zoom On-Premise Meeting Connector MMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 11, 2022Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corrCVE-2022-28750 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.5
Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.
Product
Zoom On-Premise Meeting Connector Zone Controller (ZC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 10, 2022Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hiCVE-2022-20852 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
Product
Cisco Webex Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Aug 10, 2022Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hiCVE-2022-20820 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
Product
Cisco Webex Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Jun 15, 2022Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee.CVE-2022-28749 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee. As a result, a threat actor in the Zooms waiting room can join the meeting without the consent of the host.
Product
On-Premise Meeting Connectors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 15, 2022The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installCVE-2022-22788 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.1
The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to a DLL injection attack. This vulnerability could be used to run arbitrary code on the victims host.
Product
Zoom Client for Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 2, 2022Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used.CVE-2022-31463 · Other software · Owllabs · reported by MITREHigh 8.2
Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used.
Product
Meeting OWL Pro Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arstechnica.com resources.owllabs.com
Jun 2, 2022Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth broCVE-2022-31462 · Other software · Owllabs · reported by MITRECritical 9.3
Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth broadcast data.
Product
Meeting OWL Pro Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arstechnica.com resources.owllabs.com
Jun 2, 2022Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message.CVE-2022-31461 · Other software · Owllabs · reported by MITREHigh 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message.
Product
Meeting OWL Pro Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arstechnica.com resources.owllabs.com
Jun 2, 2022Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.CVE-2022-31460 · Other software · Owllabs · reported by MITREHigh 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.
Product
Meeting OWL Pro Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arstechnica.com resources.owllabs.com
Jun 2, 2022Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.CVE-2022-31459 · Other software · Owllabs · reported by MITREHigh 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.
Product
Meeting OWL Pro Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arstechnica.com resources.owllabs.com
May 18, 2022The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch CVE-2022-22787 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 5.9
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.
Product
Zoom Client for Meetings for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com explore.zoom.us
May 18, 2022The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check theCVE-2022-22786 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.5
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.
Product
Zoom Client for Meetings for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
May 18, 2022The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domCVE-2022-22785 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 5.9
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
Product
Zoom Client for Meetings for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
May 18, 2022The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages.CVE-2022-22784 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.1
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.
Product
Zoom Client for Meetings for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
May 12, 2022This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-27773 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
Product
Sametime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 28, 2022A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes pCVE-2022-22783 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.
Product
Zoom On-Premise Meeting Connector Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Apr 28, 2022The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft CVE-2022-22782 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.9
The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine.
Product
Zoom Client for Meetings for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Apr 28, 2022The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update processCVE-2022-22781 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.5
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update process. This could lead to a malicious actor updating an unsuspecting user’s currently installed version to a less secure version.
Product
Zoom Client for Meetings for MacOS (Standard and for IT Admin)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.