Updated 23 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

391 results · page 5 of 8

Nov 14, 2023Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local accCVE-2023-43591 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.8
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Product
Zoom Rooms for macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2023-43590 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.8
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Product
Zoom Rooms for macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.CVE-2023-43588 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 3.5
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.CVE-2023-43582 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.5
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2023-39206 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 3.7
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access.CVE-2023-39205 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2023-39204 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclCVE-2023-39203 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access.
Product
Zoom Rooms Client for Windows and Zoom VDI Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.CVE-2023-39202 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 3.1
Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.
Product
Zoom Rooms Client for Windows and Zoom VDI Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Nov 14, 2023Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.CVE-2023-39199 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.9
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Sep 12, 2023Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.CVE-2023-39215 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.1
Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Sep 12, 2023Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network aCVE-2023-39208 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.5
Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access.
Product
Zoom Desktop Client for Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Sep 12, 2023Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access.CVE-2023-39201 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.2
Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access.
Product
CleanZoom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.CVE-2023-39214 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.6
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
Product
Zoom SDK's
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an CVE-2023-39213 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usCritical 9.6
Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.
Product
Zoom Desktop Client for Windows and Zoom VDI Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023 Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.CVE-2023-39212 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.9
Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.
Product
Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an informatiCVE-2023-39211 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.8
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
Product
Zoom Desktop Client for Windows and Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via CVE-2023-39210 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.5
Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access.
Product
Zoom Client SDK for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network accesCVE-2023-39209 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.9
Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access.
Product
Zoom Desktop Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.CVE-2023-39218 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 6.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.CVE-2023-39217 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.3
Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.
Product
Zoom SDK's
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network acCVE-2023-39216 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usCritical 9.6
Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
Product
Zoom Desktop Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of priviCVE-2023-36541 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8
Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.
Product
Zoom Desktop Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege viCVE-2023-36540 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.3
Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Desktop Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network acceCVE-2023-36535 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.CVE-2023-36534 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usCritical 9.3
Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
Product
Zoom Desktop Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access.CVE-2023-36533 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.1
Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access.
Product
Zoom SDK's
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Aug 8, 2023Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.CVE-2023-36532 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.9
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 26, 2023Video Conferencing with Zoom: Sensitive Information ExposureCVE-2023-3947 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.
Product
Video Conferencing with Zoom
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2023In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest caCVE-2023-30200 · Other software · Advancedplugins · reported by MITREHigh 7.5
In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest can download personal informations without restriction by performing a path traversal attack.
Product
Ultimateimagetool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security.friendsofpresta.org
Jul 11, 2023Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.CVE-2023-36538 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.4
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 11, 2023Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local accCVE-2023-36537 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.3
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 11, 2023 Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege viCVE-2023-36536 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.2
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 11, 2023Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege vCVE-2023-34119 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.2
Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 11, 2023Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local accCVE-2023-34118 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.3
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Rooms for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 11, 2023Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access.CVE-2023-34117 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 3.3
Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access.
Product
Zoom Client SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jul 11, 2023Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via nCVE-2023-34116 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.2
Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access.
Product
Zoom Desktop Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 29, 2023Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.CVE-2023-36539 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
Product
Zoom clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potentially enable a denial of service via locCVE-2023-34115 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potentially enable a denial of service via local access. This issue may result in the Zoom Meeting SDK to crash and need to be restarted.
Product
Zoom Meeting SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable informCVE-2023-34114 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.4
Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable information disclosure via network access.
Product
Zoom for Windows Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially CVE-2023-34121 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.1
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
Product
Zoom for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to poCVE-2023-34120 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.7
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.
Product
Zoom for Windows Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability.CVE-2023-28603 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.7
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
Product
Zoom VDI Windows Meeting Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability.CVE-2023-28602 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usLow 2.8
Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
Product
Zoom for Windows Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability.CVE-2023-28601 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 8.3
Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client.
Product
Zoom for Windows Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability.CVE-2023-28600 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 5.2
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client.
Product
Zoom for macOS Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.CVE-2023-28599 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usMedium 4.3
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.
Product
Zoom for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Jun 13, 2023Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability.CVE-2023-28598 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usHigh 7.5
Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
Product
Zoom for Linux clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 27, 2023Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability.CVE-2023-28597 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.3
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
Product
Zoom (for Android, iOS, Linux, macOS, and Windows)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 27, 2023Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability.CVE-2023-28596 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.8
Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
Product
Zoom Client for Meetings for IT Admin macOS installers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.