Summary
Ein Angreifer kann mehrere Schwachstellen in Zoom Video Communications Workplace und Zoom Video Communications Rooms ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, einen Denial-of-Service-Zustand herbeizuführen und Daten zu manipulieren.
Product
Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterstützen.
Zoom Rooms ist ein softwarebasiertes Raumsystem, das integrierte Audiokonferenzen, drahtlose Bildschirmfreigabe und Videokonferenzen ermöglicht.
Vulnerabilities 6
-
High 7.8
Zoom Workplace for Windows on ARM - Missing Authorization
Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of privilege via local access.
-
Medium 6.6
Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon - Race Condition
Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or before 6.2.15 and 6.3.12 in their respective tracks) may allow an authenticated user to conduct a disclosure of information via network acce…
-
Medium 5.3
Zoom Workplace Clients for Windows - Improper Action Enforcement
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access.
-
Medium 4.3
Zoom Workplace Clients - Argument Injection
Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
-
Medium 4.3
Zoom Workplace Clients - Cross-site Scripting
Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
-
Medium 4.3
Zoom Workplace Clients for Windows - Incorrect Authorization
Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-27507, EUVD-2025-27505, EUVD-2025-27506, EUVD-2025-27504, EUVD-2025-27508
-
#1
Initiale Fassung
References
-
Zoom Security Bulletin vom 2025-09-08
https://www.zoom.com/en/trust/security-bulletin/ZSB-25032/
-
Zoom Security Bulletin vom 2025-09-08
https://www.zoom.com/en/trust/security-bulletin/ZSB-25033/
-
Zoom Security Bulletin vom 2025-09-08
https://www.zoom.com/en/trust/security-bulletin/ZSB-25034/
-
Zoom Security Bulletin vom 2025-09-08
https://www.zoom.com/en/trust/security-bulletin/ZSB-25035/
-
Zoom Security Bulletin vom 2025-09-08
https://www.zoom.com/en/trust/security-bulletin/ZSB-25036/
-
Zoom Security Bulletin vom 2025-09-08
https://www.zoom.com/en/trust/security-bulletin/ZSB-25037/