Overview 144 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
144matches
2in Waratek scope1.4%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
1.4%
Outside Waratek scope
0
0.0%
Not applicable
142
98.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
144
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
144
100.0%
split by
peak 55 / year
20051
Not applicable1
High1
not blocked1
No public exploit1
20066
Not applicable6
High6
not blocked6
No public exploit6
20072
Not applicable2
High2
not blocked2
No public exploit2
20080
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20100
20110
20120
20130
20143
Not applicable3
Medium3
not blocked3
No public exploit3
20150
20160
20172
Not applicable2
Critical1
High1
not blocked2
No public exploit2
20188
Not applicable8
Critical1
High4
Medium3
not blocked8
No public exploit8
20195
Not applicable5
Critical1
High1
Medium3
not blocked5
No public exploit5
20202
Not applicable2
Critical1
High1
not blocked2
No public exploit2
202115
Not applicable15
Critical1
High6
Medium8
not blocked15
No public exploit15
202210
Not applicable10
Critical1
High4
Medium5
not blocked10
No public exploit10
202355
Not applicable55
Critical3
High37
Medium14
Low1
not blocked55
No public exploit55
202420
Not applicable20
Critical2
High5
Medium13
not blocked20
No public exploit20
202511
No exploit published2
Not applicable9
Critical2
High2
Medium5
Low2
not blocked11
No public exploit11
20263
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-53410 | High | 2026-07-16 | Not applicable | No public exploit | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. |
| CVE-2026-0998 | Medium | 2026-02-16 | Not applicable | No public exploit | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534 |
| CVE-2026-0997 | Medium | 2026-02-16 | Not applicable | No public exploit | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user when processing {{/plugins/zoom/api/v1/channel-preference}}, which allows any logged-in user to change Zoom meeting restrictions for arbitrary channels via crafted API requests.. Mattermost Advisory ID: MMSA-2025-00558 |
| CVE-2025-49464 | Medium | 2025-07-10 | Not applicable | No public exploit | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access. |
| CVE-2025-49463 | Medium | 2025-07-10 | Not applicable | No public exploit | Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2025-49462 | Low | 2025-07-10 | Not applicable | No public exploit | Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2025-46789 | Medium | 2025-07-10 | Not applicable | No public exploit | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access. |
| CVE-2025-47568 | Critical | 2025-05-23 | Not applicable | No public exploit | Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91. |
| CVE-2025-3431 | High | 2025-04-08 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. |
| CVE-2025-0839 | Medium | 2025-04-05 | Not applicable | No public exploit | The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-13776 | High | 2025-04-05 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization. |
| CVE-2024-13777 | Critical | 2025-03-05 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. |
| CVE-2025-0148 | Low | 2025-02-03 | No exploit published | No public exploit | Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access. |
| CVE-2025-0142 | Medium | 2025-01-30 | No exploit published | No public exploit | Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-9027 | Medium | 2024-09-25 | Not applicable | No public exploit | The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-8276 | Medium | 2024-08-31 | Not applicable | No public exploit | The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2022-27540 | High | 2024-06-28 | Not applicable | No public exploit | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. |
| CVE-2024-5686 | Medium | 2024-06-20 | Not applicable | No public exploit | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-5147 | Critical | 2024-05-22 | Not applicable | No public exploit | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. |
| CVE-2024-4370 | Medium | 2024-05-15 | Not applicable | No public exploit | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-33539 | Medium | 2024-04-29 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35. |
| CVE-2024-27247 | Medium | 2024-04-09 | Not applicable | No public exploit | Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2024-27242 | Medium | 2024-04-09 | Not applicable | No public exploit | Cross site scripting in Zoom Desktop Client for Linux before version 5.17.10 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-24694 | High | 2024-04-09 | Not applicable | No public exploit | Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-2031 | Medium | 2024-03-12 | Not applicable | No public exploit | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-24699 | Medium | 2024-02-14 | Not applicable | No public exploit | Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access. |
| CVE-2024-24698 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. |
| CVE-2024-24697 | High | 2024-02-14 | Not applicable | No public exploit | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-24696 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-24695 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-24691 | Critical | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. |
| CVE-2024-24690 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-22162 | High | 2024-01-31 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.3. |
| CVE-2023-49647 | High | 2024-01-12 | Not applicable | No public exploit | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2023-49646 | Medium | 2023-12-13 | Not applicable | No public exploit | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-43586 | High | 2023-12-13 | Not applicable | No public exploit | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2023-43585 | High | 2023-12-13 | Not applicable | No public exploit | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2023-43583 | Medium | 2023-12-13 | Not applicable | No public exploit | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access. |
| CVE-2023-43588 | Medium | 2023-11-15 | Not applicable | No public exploit | Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access. |
| CVE-2023-43582 | High | 2023-11-15 | Not applicable | No public exploit | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
| CVE-2023-39206 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39205 | Medium | 2023-11-14 | Not applicable | No public exploit | Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39204 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39203 | High | 2023-11-14 | Not applicable | No public exploit | Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2023-39199 | Medium | 2023-11-14 | Not applicable | No public exploit | Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2023-39215 | High | 2023-09-12 | Not applicable | No public exploit | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39208 | High | 2023-09-12 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39201 | High | 2023-09-12 | Not applicable | No public exploit | Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2023-39218 | Medium | 2023-08-08 | Not applicable | No public exploit | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access. |
| CVE-2023-39216 | Critical | 2023-08-08 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access. |
| CVE-2023-39214 | High | 2023-08-08 | Not applicable | No public exploit | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access. |
| CVE-2023-39213 | Critical | 2023-08-08 | Not applicable | No public exploit | Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access. |
| CVE-2023-39211 | High | 2023-08-08 | Not applicable | No public exploit | Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access. |
| CVE-2023-39209 | Medium | 2023-08-08 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access. |
| CVE-2023-36541 | High | 2023-08-08 | Not applicable | No public exploit | Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access. |
| CVE-2023-36540 | High | 2023-08-08 | Not applicable | No public exploit | Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access. |
| CVE-2023-36535 | High | 2023-08-08 | Not applicable | No public exploit | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access. |
| CVE-2023-36534 | Critical | 2023-08-08 | Not applicable | No public exploit | Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access. |
| CVE-2023-36532 | High | 2023-08-08 | Not applicable | No public exploit | Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access. |
| CVE-2023-3947 | Medium | 2023-07-26 | Not applicable | No public exploit | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password. |
| CVE-2023-34117 | Low | 2023-07-11 | Not applicable | No public exploit | Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access. |
| CVE-2023-34116 | High | 2023-07-11 | Not applicable | No public exploit | Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access. |
| CVE-2023-36539 | High | 2023-06-30 | Not applicable | No public exploit | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
| CVE-2023-34121 | High | 2023-06-13 | Not applicable | No public exploit | Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access. |
| CVE-2023-34114 | High | 2023-06-13 | Not applicable | No public exploit | Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable information disclosure via network access. |
| CVE-2023-28602 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions. |
| CVE-2023-28601 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client. |
| CVE-2023-28600 | Medium | 2023-06-13 | Not applicable | No public exploit | Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client. |
| CVE-2023-28599 | Medium | 2023-06-13 | Not applicable | No public exploit | Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation. |
| CVE-2023-28598 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash. |
| CVE-2022-31639 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31638 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31637 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31636 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31635 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-43778 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-43777 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-27541 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-27539 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2023-28597 | High | 2023-03-27 | Not applicable | No public exploit | Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution. |
| CVE-2023-22882 | High | 2023-03-16 | Not applicable | No public exploit | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. |
| CVE-2023-22881 | High | 2023-03-16 | Not applicable | No public exploit | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. |
| CVE-2023-22880 | High | 2023-03-16 | Not applicable | No public exploit | Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior. |
| CVE-2021-3439 | High | 2023-02-01 | Not applicable | No public exploit | HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities. |
| CVE-2022-40137 | Medium | 2023-01-30 | Not applicable | No public exploit | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
| CVE-2022-40136 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-40135 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-40134 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-36928 | High | 2023-01-09 | Not applicable | No public exploit | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory. |
| CVE-2022-28761 | Medium | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and video causing meeting disruptions. |
| CVE-2022-28760 | Medium | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2022-28759 | High | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2022-28758 | High | 2022-09-16 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2022-28755 | Critical | 2022-08-11 | Not applicable | No public exploit | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths. |
| CVE-2022-22783 | High | 2022-04-28 | Not applicable | No public exploit | A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker. |
| CVE-2022-22782 | High | 2022-04-28 | Not applicable | No public exploit | The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine. |
| CVE-2022-25615 | Medium | 2022-04-11 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion. |
| CVE-2022-25614 | Medium | 2022-04-11 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings. |
| CVE-2022-0384 | Medium | 2022-03-07 | Not applicable | No public exploit | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog |
| CVE-2021-34424 | High | 2021-11-24 | Not applicable | No public exploit | A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom on-premise Meeting Connector before version 4.8.12.20211115, Zoom on-premise Meeting Connector MMR before version 4.8.12.20211115, Zoom on-premise Recording Connector before version 5.1.0.65.20211116, Zoom on-premise Virtual Room Connector before version 4.4.7266.20211117, Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64 which potentially allowed for the exposure of the state of process memory. This issue could be used to potentially gain insight into arbitrary areas of the product's memory. |