Zoom
Page 3 of 3 — Zoom CVEs from a corpus of 236, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34425 | Medium | 4.7 | 2021-12-14 | The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat… |
CVE-2021-34424 | High | 7.5 | 2021-11-24 | A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for… |
CVE-2021-34423 | Critical | 9.8 | 2021-11-24 | A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for… |
CVE-2021-34420 | Medium | 4.7 | 2021-11-11 | The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. T… |
CVE-2021-34419 | Low | 3.7 | 2021-11-11 | In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the p… |
CVE-2021-34418 | Medium | 4.0 | 2021-11-11 | The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before ver… |
CVE-2021-34417 | High | 7.9 | 2021-11-11 | The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connecto… |
CVE-2021-34416 | Critical | 9.8 | 2021-09-27 | The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting Conne… |
CVE-2021-34415 | High | 7.5 | 2021-09-27 | The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming… |
CVE-2021-34414 | High | 7.2 | 2021-09-27 | The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting Connecto… |
CVE-2021-34413 | High | 7.5 | 2021-09-27 | All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerability during the pl… |
CVE-2021-34412 | High | 7.8 | 2021-09-27 | During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer. If the i… |
CVE-2021-34411 | High | 7.8 | 2021-09-27 | During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated pri… |
CVE-2021-34410 | High | 7.8 | 2021-09-27 | A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows f… |
CVE-2021-34409 | High | 7.8 | 2021-09-27 | It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom… |
CVE-2021-34408 | High | 7.8 | 2021-09-27 | The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged user during the ins… |
CVE-2021-33907 | Critical | 9.8 | 2021-09-27 | The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when perfo… |
CVE-2021-30480 | High | 8.5 | 2021-04-09 | Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker… |
CVE-2021-28133 | Medium | 4.3 | 2021-03-18 | Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the p… |
CVE-2020-9767 | High | 7.8 | 2020-08-14 | A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which… |
CVE-2020-6110 | High | 8.8 | 2020-06-08 | An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially… |
CVE-2020-6109 | Critical | 9.8 | 2020-06-08 | An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat mess… |
CVE-2020-11443 | High | 8.1 | 2020-05-04 | The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version… |
CVE-2020-11877 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption. NOTE: the vendor states that… |
CVE-2020-11876 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE… |
CVE-2020-11500 | High | 7.5 | 2020-04-03 | Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key. |
CVE-2020-11470 | Low | 3.3 | 2020-04-01 | Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to ob… |
CVE-2020-11469 | High | 7.8 | 2020-04-01 | Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (wi… |
CVE-2019-13567 | High | 8.8 | 2019-07-12 | The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the h… |
CVE-2019-13450 | Medium | 6.5 | 2019-07-09 | In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active… |
CVE-2019-13449 | Medium | 6.5 | 2019-07-09 | In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&c… |
CVE-2018-15715 | Critical | 9.8 | 2018-11-30 | Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauth… |
CVE-2017-15049 | High | 8.8 | 2017-12-19 | The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allo… |
CVE-2017-15048 | High | 8.8 | 2017-12-19 | Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by… |
CVE-2014-5811 | | 2014-09-09 | The ZOOM Cloud Meetings (aka us.zoom.videomeetings) application @7F060008 for Android does not verify X.509 certificates from SSL servers, which allows man-in-… | |
CVE-2004-0680 | | 2004-08-06 | Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed fo… |