Apache Software Foundation Apache Openmeetings
23 CVEs affecting Apache Software Foundation Apache Openmeetings. Latest disclosed: 2026-07-14. Critical: 5, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7664 | Critical | 10.0 | 2017-07-17 | Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. |
CVE-2024-54676 | Critical | 9.8 | 2025-01-08 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https… |
CVE-2023-28326 | Critical | 9.8 | 2023-03-28 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in a… |
CVE-2016-8736 | Critical | 9.8 | 2017-10-12 | Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. |
CVE-2017-7673 | Critical | 9.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing br… |
CVE-2017-7681 | High | 8.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure… |
CVE-2017-7666 | High | 8.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. |
CVE-2017-7682 | High | 8.2 | 2017-07-17 | Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas. |
CVE-2023-29032 | High | 8.1 | 2023-05-12 | An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected… |
CVE-2026-34020 | High | 7.5 | 2026-04-09 | Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and pa… |
CVE-2026-33266 | High | 7.5 | 2026-04-09 | Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.proper… |
CVE-2021-27576 | High | 7.5 | 2021-03-15 | If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeeting… |
CVE-2017-7688 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 updates user password in insecure manner. |
CVE-2017-7684 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the se… |
CVE-2017-7683 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. |
CVE-2017-7680 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains. |
CVE-2023-29246 | High | 7.2 | 2023-05-12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apach… |
CVE-2026-49488 | Medium | 6.5 | 2026-07-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: f… |
CVE-2018-1286 | Medium | 6.5 | 2018-02-28 | In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for pri… |
CVE-2017-7663 | Medium | 6.1 | 2017-07-17 | Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. |