WaratekVRT Sign in

High Openmeetings CVEs

14 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
Product openmeetings✕
Overview 14 matches · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
14matches 1protected7.1% 0exploited0.0% 0CISA KEV0.0% 1public PoC7.1% 1EPSS ≥ 0.57.1%
Protected by Waratek 1 7.1% Rule in development 0 0.0% Mitigation candidate 1 7.1% No exploit published 12 85.7%
Critical 0 0.0% High 14 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 7.1% partly blocked 0 0.0% not blocked 13 92.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 7.1% Proof of concept only 1 7.1% Forecast only 0 0.0% No public exploit 12 85.7%
split by peak 7 / year
No exploit published: 12Mitigation candidate: 1Protected by Waratek: 1 High: 14 not blocked: 13blocked by ARMR today: 1 No public exploit: 12Proof of concept only: 1Working exploit published: 1
20161 No exploit published1 High1 not blocked1 No public exploit1 20177 Protected by Waratek1 No exploit published6 High7 blocked by ARMR today1 not blocked6 No public exploit7 20180 20190 20201 Mitigation candidate1 High1 not blocked1 Working exploit published1 20211 No exploit published1 High1 not blocked1 No public exploit1 20220 20232 No exploit published2 High2 not blocked2 No public exploit2 20240 20250 20262 No exploit published2 High2 not blocked2 Proof of concept only1 No public exploit1
20162017201820192020202120222023202420252026
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-34020 High 2026-04-09 No exploit published Proof of concept only Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
CVE-2026-33266 High 2026-04-09 No exploit published No public exploit Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials. This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
CVE-2023-29246 High 2023-05-12 No exploit published No public exploit An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
CVE-2023-29032 High 2023-05-12 No exploit published No public exploit An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0
CVE-2021-27576 High 2021-03-15 No exploit published No public exploit If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0
CVE-2020-13951 High 2020-09-30 Mitigation candidate Working exploit published Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
CVE-2017-7688 High 2017-07-17 No exploit published No public exploit Apache OpenMeetings 1.0.0 updates user password in insecure manner.
CVE-2017-7684 High 2017-07-17 No exploit published No public exploit Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.
CVE-2017-7683 High 2017-07-17 No exploit published No public exploit Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.
CVE-2017-7682 High 2017-07-17 No exploit published No public exploit Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
CVE-2017-7681 High 2017-07-17 Protected by Waratek No public exploit Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
CVE-2017-7680 High 2017-07-17 No exploit published No public exploit Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
CVE-2017-7666 High 2017-07-17 No exploit published No public exploit Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
CVE-2016-2164 High 2016-04-11 No exploit published No public exploit The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.