Overview 169 matches · 2 in Waratek scope · 0 protected · 3 exploited · 0 CISA KEV · 19 public PoC · 4 EPSS ≥ 0.5
169matches
2in Waratek scope1.2%
0protected0.0%
3exploited1.8%
0CISA KEV0.0%
19public PoC11.2%
4EPSS ≥ 0.52.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
1.2%
Outside Waratek scope
0
0.0%
Not applicable
167
98.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
169
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 57 / year
20031
Not applicable1
Medium1
not blocked1
Working exploit published1
20040
20052
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
200611
Not applicable11
High8
Medium3
not blocked11
Working exploit published5
No public exploit6
20074
Not applicable4
High4
not blocked4
Working exploit published2
No public exploit2
20080
20092
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
20100
20110
20120
20130
20143
Not applicable3
Medium3
not blocked3
No public exploit3
20150
20160
20174
Not applicable4
Critical1
High3
not blocked4
Working exploit published2
No public exploit2
201811
Not applicable11
Critical4
High4
Medium3
not blocked11
Exploited1
Working exploit published2
No public exploit8
20195
Not applicable5
Critical1
High1
Medium3
not blocked5
No public exploit5
20202
Not applicable2
Critical1
High1
not blocked2
No public exploit2
202116
Not applicable16
Critical1
High7
Medium8
not blocked16
Exploited1
No public exploit15
202212
Not applicable12
Critical1
High5
Medium6
not blocked12
Working exploit published2
No public exploit10
202357
Not applicable57
Critical3
High37
Medium16
Low1
not blocked57
Proof of concept only2
No public exploit55
202424
Not applicable24
Critical4
High5
Medium15
not blocked24
Exploited1
Proof of concept only3
No public exploit20
202512
No exploit published2
Not applicable10
Critical3
High2
Medium5
Low2
not blocked12
Proof of concept only1
No public exploit11
20263
Not applicable3
High1
Medium2
not blocked3
No public exploit3
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-53410 | High | 2026-07-16 | Not applicable | No public exploit | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. |
| CVE-2026-0998 | Medium | 2026-02-16 | Not applicable | No public exploit | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534 |
| CVE-2026-0997 | Medium | 2026-02-16 | Not applicable | No public exploit | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user when processing {{/plugins/zoom/api/v1/channel-preference}}, which allows any logged-in user to change Zoom meeting restrictions for arbitrary channels via crafted API requests.. Mattermost Advisory ID: MMSA-2025-00558 |
| CVE-2025-49464 | Medium | 2025-07-10 | Not applicable | No public exploit | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access. |
| CVE-2025-49463 | Medium | 2025-07-10 | Not applicable | No public exploit | Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2025-49462 | Low | 2025-07-10 | Not applicable | No public exploit | Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2025-46789 | Medium | 2025-07-10 | Not applicable | No public exploit | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access. |
| CVE-2021-4457 | Critical | 2025-06-25 | Not applicable | Proof of concept only | The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server. |
| CVE-2025-47568 | Critical | 2025-05-23 | Not applicable | No public exploit | Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91. |
| CVE-2025-3431 | High | 2025-04-08 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. |
| CVE-2025-0839 | Medium | 2025-04-05 | Not applicable | No public exploit | The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-13776 | High | 2025-04-05 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization. |
| CVE-2024-13777 | Critical | 2025-03-05 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. |
| CVE-2025-0148 | Low | 2025-02-03 | No exploit published | No public exploit | Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access. |
| CVE-2025-0142 | Medium | 2025-01-30 | No exploit published | No public exploit | Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-9934 | Medium | 2024-11-06 | Not applicable | Proof of concept only | The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2021-4449 | Critical | 2024-10-16 | Not applicable | Exploited | The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this. |
| CVE-2024-9027 | Medium | 2024-09-25 | Not applicable | No public exploit | The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-8276 | Medium | 2024-08-31 | Not applicable | No public exploit | The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2022-27540 | High | 2024-06-28 | Not applicable | No public exploit | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. |
| CVE-2024-5686 | Medium | 2024-06-20 | Not applicable | No public exploit | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-5147 | Critical | 2024-05-22 | Not applicable | No public exploit | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. |
| CVE-2024-4370 | Medium | 2024-05-15 | Not applicable | No public exploit | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-33539 | Medium | 2024-04-29 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35. |
| CVE-2024-27247 | Medium | 2024-04-09 | Not applicable | No public exploit | Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2024-27242 | Medium | 2024-04-09 | Not applicable | No public exploit | Cross site scripting in Zoom Desktop Client for Linux before version 5.17.10 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-24694 | High | 2024-04-09 | Not applicable | No public exploit | Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-2031 | Medium | 2024-03-12 | Not applicable | No public exploit | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-24699 | Medium | 2024-02-14 | Not applicable | No public exploit | Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access. |
| CVE-2024-24698 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. |
| CVE-2024-24697 | High | 2024-02-14 | Not applicable | No public exploit | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-24696 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-24695 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2024-24691 | Critical | 2024-02-14 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. |
| CVE-2024-24690 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-22162 | High | 2024-01-31 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.3. |
| CVE-2022-41619 | Medium | 2024-01-17 | Not applicable | Proof of concept only | Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8. |
| CVE-2023-49647 | High | 2024-01-12 | Not applicable | No public exploit | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2023-50027 | Critical | 2024-01-05 | Not applicable | Proof of concept only | SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method. |
| CVE-2023-49646 | Medium | 2023-12-13 | Not applicable | No public exploit | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-43586 | High | 2023-12-13 | Not applicable | No public exploit | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2023-43585 | High | 2023-12-13 | Not applicable | No public exploit | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2023-43583 | Medium | 2023-12-13 | Not applicable | No public exploit | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access. |
| CVE-2023-43588 | Medium | 2023-11-15 | Not applicable | No public exploit | Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access. |
| CVE-2023-43582 | High | 2023-11-15 | Not applicable | No public exploit | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
| CVE-2023-39206 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39205 | Medium | 2023-11-14 | Not applicable | No public exploit | Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39204 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39203 | High | 2023-11-14 | Not applicable | No public exploit | Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2023-39199 | Medium | 2023-11-14 | Not applicable | No public exploit | Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
| CVE-2023-39215 | High | 2023-09-12 | Not applicable | No public exploit | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39208 | High | 2023-09-12 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39201 | High | 2023-09-12 | Not applicable | No public exploit | Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2023-39218 | Medium | 2023-08-08 | Not applicable | No public exploit | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access. |
| CVE-2023-39216 | Critical | 2023-08-08 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access. |
| CVE-2023-39214 | High | 2023-08-08 | Not applicable | No public exploit | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access. |
| CVE-2023-39213 | Critical | 2023-08-08 | Not applicable | No public exploit | Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access. |
| CVE-2023-39211 | High | 2023-08-08 | Not applicable | No public exploit | Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access. |
| CVE-2023-39209 | Medium | 2023-08-08 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access. |
| CVE-2023-36541 | High | 2023-08-08 | Not applicable | No public exploit | Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access. |
| CVE-2023-36540 | High | 2023-08-08 | Not applicable | No public exploit | Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access. |
| CVE-2023-36535 | High | 2023-08-08 | Not applicable | No public exploit | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access. |
| CVE-2023-36534 | Critical | 2023-08-08 | Not applicable | No public exploit | Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access. |
| CVE-2023-36532 | High | 2023-08-08 | Not applicable | No public exploit | Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access. |
| CVE-2023-3947 | Medium | 2023-07-26 | Not applicable | No public exploit | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password. |
| CVE-2023-34117 | Low | 2023-07-11 | Not applicable | No public exploit | Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access. |
| CVE-2023-34116 | High | 2023-07-11 | Not applicable | No public exploit | Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access. |
| CVE-2023-36539 | High | 2023-06-30 | Not applicable | No public exploit | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
| CVE-2023-34121 | High | 2023-06-13 | Not applicable | No public exploit | Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access. |
| CVE-2023-34114 | High | 2023-06-13 | Not applicable | No public exploit | Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable information disclosure via network access. |
| CVE-2023-28602 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions. |
| CVE-2023-28601 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client. |
| CVE-2023-28600 | Medium | 2023-06-13 | Not applicable | No public exploit | Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client. |
| CVE-2023-28599 | Medium | 2023-06-13 | Not applicable | No public exploit | Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation. |
| CVE-2023-28598 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash. |
| CVE-2022-31639 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31638 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31637 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31636 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31635 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-43778 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-43777 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-27541 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-27539 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2023-28597 | High | 2023-03-27 | Not applicable | No public exploit | Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution. |
| CVE-2023-22882 | High | 2023-03-16 | Not applicable | No public exploit | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. |
| CVE-2023-22881 | High | 2023-03-16 | Not applicable | No public exploit | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. |
| CVE-2023-22880 | High | 2023-03-16 | Not applicable | No public exploit | Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior. |
| CVE-2021-3439 | High | 2023-02-01 | Not applicable | No public exploit | HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities. |
| CVE-2022-40137 | Medium | 2023-01-30 | Not applicable | No public exploit | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
| CVE-2022-40136 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-40135 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-40134 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-4789 | Medium | 2023-01-23 | Not applicable | Proof of concept only | The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. |
| CVE-2022-4578 | Medium | 2023-01-16 | Not applicable | Proof of concept only | The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. |
| CVE-2022-36928 | High | 2023-01-09 | Not applicable | No public exploit | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory. |
| CVE-2022-28761 | Medium | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and video causing meeting disruptions. |
| CVE-2022-28760 | Medium | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2022-28759 | High | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2022-28758 | High | 2022-09-16 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |