Skip to content
OpenAdvisories
Medium WID-SEC-2025-0735 6 CVEs

Zoom Video Communications Workplace und Rooms: Mehrere Schwachstellen

Published Apr 7, 2025 · Updated Apr 7, 2025 · de-DE

Vendor: Zoom Video Communications Product: Rooms Product: Workplace Platform: Android Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Zoom Video Communications Workplace und Rooms ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren.

Product

Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterstützen.
Zoom Rooms ist ein softwarebasiertes Raumsystem, das integrierte Audiokonferenzen, drahtlose Bildschirmfreigabe und Videokonferenzen ermöglicht.

Vulnerabilities 6

  • Medium 6.5
    CVE-2025-30670

    Zoom Workplace Apps for Windows - Null Pointer

    Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

    Zoom Communications Zoom Workplace Apps for Windows Windows
  • Medium 6.5
    CVE-2025-30671

    Zoom Workplace Apps for Windows - Null Pointer

    Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

    Zoom Communications Zoom Workplace Apps for Windows Windows
  • Medium 6.5
    CVE-2025-30672

    Mite for Perl generates code with an untrusted search path vulnerability

    Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, poten…

    TOBYINK Mite
  • Medium 4.6
    CVE-2025-27441

    Zoom Workplace Apps - Cross Site Scripting

    Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

    Zoom Communications Zoom Workplace Apps
  • Medium 4.6
    CVE-2025-27442

    Zoom Workplace Apps - Cross Site Scripting

    Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

    Zoom Communications Zoom Workplace Apps
  • Low 2.8
    CVE-2025-27443

    Zoom Workplace Apps for Windows - Insecure Default Variable Initialization

    Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.

    Zoom Communications Zoom Workplace Apps for Windows Windows

Revision history

  1. #1

    Initiale Fassung

References