Overview 895 matches · 10 in Waratek scope · 3 protected · 25 exploited · 14 CISA KEV · 58 public PoC · 36 EPSS ≥ 0.5
895matches
10in Waratek scope1.1%
3protected0.3%
25exploited2.8%
14CISA KEV1.6%
58public PoC6.5%
36EPSS ≥ 0.54.0%
Protected by Waratek
3
0.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
7
0.8%
Outside Waratek scope
47
5.3%
Not applicable
838
93.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.3%
partly blocked
0
0.0%
not blocked
892
99.7%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 122 / year
20071
Not applicable1
Low1
not blocked1
No public exploit1
20084
Not applicable4
High3
Medium1
not blocked4
No public exploit4
20094
Not applicable4
High1
Low3
not blocked4
No public exploit4
201017
Not applicable17
High1
Medium7
Low9
not blocked17
Exploited2
Working exploit published5
No public exploit10
201110
Not applicable10
High4
Medium5
Low1
not blocked10
Exploited2
No public exploit8
201258
No exploit published1
Outside Waratek scope3
Not applicable54
Critical2
High39
Medium16
Low1
not blocked58
Exploited2
Working exploit published4
No public exploit52
201358
Outside Waratek scope1
Not applicable57
Critical7
High28
Medium22
Low1
not blocked58
Exploited3
Working exploit published4
No public exploit51
201475
Outside Waratek scope8
Not applicable67
Critical10
High18
Medium42
Low5
not blocked75
Exploited4
Working exploit published1
Proof of concept only1
Forecast only2
No public exploit67
201562
No exploit published2
Outside Waratek scope11
Not applicable49
Critical1
High21
Medium29
Low11
not blocked62
Exploited3
Working exploit published1
Proof of concept only1
Forecast only1
No public exploit56
201681
Protected by Waratek2
No exploit published2
Outside Waratek scope2
Not applicable75
Critical13
High25
Medium42
Low1
blocked by ARMR today2
not blocked79
Exploited4
Working exploit published12
Forecast only2
No public exploit63
201735
Not applicable35
Critical11
High17
Medium7
not blocked35
Working exploit published1
No public exploit34
20187
Outside Waratek scope2
Not applicable5
Critical2
High2
Medium3
not blocked7
Exploited1
Forecast only1
No public exploit5
201912
Outside Waratek scope2
Not applicable10
Critical1
High6
Medium5
not blocked12
No public exploit12
202042
Outside Waratek scope3
Not applicable39
Critical3
High21
Medium16
Low2
not blocked42
Working exploit published1
Proof of concept only2
No public exploit39
202168
No exploit published1
Outside Waratek scope8
Not applicable59
Critical11
High43
Medium11
Low3
not blocked68
Exploited2
Forecast only3
No public exploit63
202256
No exploit published1
Outside Waratek scope4
Not applicable51
Critical8
High32
Medium16
not blocked56
Exploited1
Working exploit published3
No public exploit52
202373
Not applicable73
Critical13
High40
Medium18
Low2
not blocked73
Proof of concept only8
No public exploit65
202481
Protected by Waratek1
Not applicable80
Critical9
High39
Medium32
Low1
blocked by ARMR today1
not blocked80
Exploited1
Proof of concept only17
No public exploit63
2025122
Outside Waratek scope3
Not applicable119
Critical14
High48
Medium60
not blocked122
Proof of concept only4
No public exploit118
202629
Not applicable29
Critical1
High13
Medium15
not blocked29
Proof of concept only1
No public exploit28
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-30664 | High | 2025-05-14 | Not applicable | No public exploit | Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2025-30663 | High | 2025-05-14 | Not applicable | No public exploit | Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2025-30422 | Medium | 2025-04-30 | Not applicable | No public exploit | A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination. |
| CVE-2025-24132 | Medium | 2025-04-30 | Not applicable | Proof of concept only | The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination. |
| CVE-2025-30671 | Medium | 2025-04-08 | Not applicable | No public exploit | Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2025-30670 | Medium | 2025-04-08 | Not applicable | No public exploit | Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2025-30309 | Medium | 2025-04-08 | Not applicable | No public exploit | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-30308 | Medium | 2025-04-08 | Not applicable | No public exploit | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-30307 | Medium | 2025-04-08 | Not applicable | No public exploit | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-30306 | Medium | 2025-04-08 | Not applicable | No public exploit | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-30305 | Medium | 2025-04-08 | Not applicable | No public exploit | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-27443 | Medium | 2025-04-08 | Not applicable | No public exploit | Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access. |
| CVE-2025-27442 | Medium | 2025-04-08 | Not applicable | No public exploit | Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. |
| CVE-2025-27441 | Medium | 2025-04-08 | Not applicable | No public exploit | Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. |
| CVE-2025-20664 | High | 2025-04-07 | Not applicable | No public exploit | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406217; Issue ID: MSV-2773. |
| CVE-2025-20663 | High | 2025-04-07 | Not applicable | No public exploit | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00408868; Issue ID: MSV-3031. |
| CVE-2025-20654 | Critical | 2025-04-07 | Not applicable | No public exploit | In wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406897; Issue ID: MSV-2875. |
| CVE-2024-24292 | Critical | 2025-03-28 | Not applicable | Proof of concept only | A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. |
| CVE-2025-27440 | High | 2025-03-11 | Not applicable | No public exploit | Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-27439 | High | 2025-03-11 | Not applicable | No public exploit | Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-0151 | High | 2025-03-11 | Not applicable | No public exploit | Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-0150 | High | 2025-03-11 | Not applicable | No public exploit | Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2025-0149 | High | 2025-03-11 | Not applicable | No public exploit | Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. |
| CVE-2025-20649 | Medium | 2025-03-03 | Not applicable | No public exploit | In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00396437; Issue ID: MSV-2184. |
| CVE-2025-20646 | Critical | 2025-03-03 | Not applicable | No public exploit | In wlan AP FW, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389074; Issue ID: MSV-1803. |
| CVE-2024-45426 | Medium | 2025-02-25 | Not applicable | No public exploit | Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2024-45425 | Medium | 2025-02-25 | Not applicable | No public exploit | Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2024-45424 | High | 2025-02-25 | Not applicable | No public exploit | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2024-45421 | High | 2025-02-25 | Not applicable | No public exploit | Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2024-45418 | High | 2025-02-25 | Not applicable | No public exploit | Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2024-45417 | Medium | 2025-02-25 | Not applicable | No public exploit | Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access. |
| CVE-2024-27246 | Medium | 2025-02-25 | Not applicable | No public exploit | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-27245 | Medium | 2025-02-25 | Not applicable | No public exploit | Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-27239 | Medium | 2025-02-25 | Not applicable | No public exploit | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2025-24928 | High | 2025-02-18 | Outside Waratek scope | No public exploit | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. |
| CVE-2024-56171 | Critical | 2025-02-18 | Outside Waratek scope | No public exploit | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. |
| CVE-2025-20637 | High | 2025-02-03 | Not applicable | No public exploit | In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00399035; Issue ID: MSV-2380. |
| CVE-2025-20633 | High | 2025-02-03 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00400889; Issue ID: MSV-2491. |
| CVE-2025-20632 | High | 2025-02-03 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397139; Issue ID: MSV-2188. |
| CVE-2025-20631 | High | 2025-02-03 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397141; Issue ID: MSV-2187. |
| CVE-2024-20147 | Medium | 2025-02-03 | Not applicable | No public exploit | In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389046 (Note: For MT79XX chipsets) / ALPS09136501 (Note: For MT2737, MT3603, MT6XXX, and MT8XXX chipsets); Issue ID: MSV-1797. |
| CVE-2025-0147 | Critical | 2025-01-30 | Not applicable | No public exploit | Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access. |
| CVE-2025-0146 | Medium | 2025-01-30 | Not applicable | No public exploit | Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access. |
| CVE-2025-0145 | High | 2025-01-30 | Not applicable | No public exploit | Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access. |
| CVE-2025-0144 | Medium | 2025-01-30 | Not applicable | No public exploit | Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access. |
| CVE-2025-0143 | Medium | 2025-01-30 | Not applicable | No public exploit | Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access. |
| CVE-2024-13176 | Medium | 2025-01-20 | Outside Waratek scope | No public exploit | Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. |
| CVE-2024-20153 | High | 2025-01-06 | Not applicable | No public exploit | In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598. |
| CVE-2024-20152 | Medium | 2025-01-06 | Not applicable | No public exploit | In wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00389047 / ALPS09136505; Issue ID: MSV-1798. |
| CVE-2024-20148 | Critical | 2025-01-06 | Not applicable | No public exploit | In wlan STA FW, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389045 / ALPS09136494; Issue ID: MSV-1796. |
| CVE-2024-20146 | High | 2025-01-06 | Not applicable | No public exploit | In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1835. |
| CVE-2024-50931 | Medium | 2024-12-10 | Not applicable | No public exploit | Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. |
| CVE-2024-50930 | High | 2024-12-10 | Not applicable | No public exploit | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. |
| CVE-2024-50929 | Medium | 2024-12-10 | Not applicable | No public exploit | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS). |
| CVE-2024-50928 | Medium | 2024-12-10 | Not applicable | No public exploit | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communications with the controller. |
| CVE-2024-50924 | Medium | 2024-12-10 | Not applicable | No public exploit | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller. |
| CVE-2024-50921 | Medium | 2024-12-10 | Not applicable | No public exploit | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller. |
| CVE-2024-50920 | High | 2024-12-10 | Not applicable | No public exploit | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. |
| CVE-2024-10256 | High | 2024-12-10 | Not applicable | No public exploit | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. |
| CVE-2023-7298 | High | 2024-12-09 | Not applicable | No public exploit | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. |
| CVE-2024-20139 | Medium | 2024-12-02 | Not applicable | No public exploit | In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09001270; Issue ID: MSV-1600. |
| CVE-2024-20138 | High | 2024-12-02 | Not applicable | No public exploit | In wlan driver, there is a possible out of bound read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998291; Issue ID: MSV-1604. |
| CVE-2024-45422 | High | 2024-11-19 | Not applicable | No public exploit | Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2024-45420 | Medium | 2024-11-19 | Not applicable | No public exploit | Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-45419 | High | 2024-11-19 | Not applicable | No public exploit | Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2024-21945 | High | 2024-11-12 | Not applicable | No public exploit | Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. |
| CVE-2024-20103 | Critical | 2024-10-07 | Not applicable | No public exploit | In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09001358; Issue ID: MSV-1599. |
| CVE-2024-20101 | Critical | 2024-10-07 | Not applicable | No public exploit | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998901; Issue ID: MSV-1602. |
| CVE-2024-20100 | Critical | 2024-10-07 | Not applicable | No public exploit | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998449; Issue ID: MSV-1603. |
| CVE-2024-42441 | Medium | 2024-08-14 | Not applicable | No public exploit | Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2024-42440 | Medium | 2024-08-14 | Not applicable | No public exploit | Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2024-42439 | Medium | 2024-08-14 | Not applicable | No public exploit | Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2024-42438 | Medium | 2024-08-14 | Not applicable | No public exploit | Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-42437 | Medium | 2024-08-14 | Not applicable | No public exploit | Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-42436 | Medium | 2024-08-14 | Not applicable | No public exploit | Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-42435 | Medium | 2024-08-14 | Not applicable | No public exploit | Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2024-42434 | Medium | 2024-08-14 | Not applicable | No public exploit | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2024-39824 | Medium | 2024-08-14 | Not applicable | No public exploit | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2024-39823 | Medium | 2024-08-14 | Not applicable | No public exploit | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2024-39822 | Medium | 2024-08-14 | Not applicable | No public exploit | Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access. |
| CVE-2024-23909 | Medium | 2024-08-14 | Not applicable | No public exploit | Uncontrolled search path in some Intel(R) FPGA SDK for OpenCL(TM) software technology may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2024-39826 | Medium | 2024-07-15 | Not applicable | No public exploit | Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access. |
| CVE-2024-39819 | High | 2024-07-15 | Not applicable | No public exploit | Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access. |
| CVE-2024-27241 | High | 2024-07-15 | Not applicable | No public exploit | Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-27238 | High | 2024-07-15 | Not applicable | No public exploit | Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access. |
| CVE-2023-41093 | Low | 2024-07-12 | Not applicable | No public exploit | Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0. |
| CVE-2024-38086 | Medium | 2024-07-09 | Not applicable | No public exploit | Azure Kinect SDK Remote Code Execution Vulnerability |
| CVE-2024-21778 | High | 2024-07-08 | Not applicable | Proof of concept only | A heap-based buffer overflow vulnerability exists in the configuration file mib_init_value_array functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted .dat file can lead to arbitrary code execution. An attacker can upload a malicious file to trigger this vulnerability. |
| CVE-2023-50383 | High | 2024-07-08 | Not applicable | Proof of concept only | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `localPin` request's parameter. |
| CVE-2023-50382 | High | 2024-07-08 | Not applicable | Proof of concept only | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `peerPin` request's parameter. |
| CVE-2023-50381 | High | 2024-07-08 | Not applicable | Exploited | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `targetAPSsid` request's parameter. |
| CVE-2023-50330 | High | 2024-07-08 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger this vulnerability. |
| CVE-2023-50244 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `entry_name` request's parameter. |
| CVE-2023-50243 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `comment` request's parameter. |
| CVE-2023-50240 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `AdvDefaultPreference` request's parameter. |
| CVE-2023-50239 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `interfacename` request's parameter. |
| CVE-2023-49867 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger this vulnerability. |
| CVE-2023-49595 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa rollback_control_code functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-49073 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-48270 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |