Vendor
Zoom Video Communications
117 known vulnerabilities.
Products
46 results · Clear filters · Feed
-
Medium 6.7
Zoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
-
Medium 6.5
Zoom Apps - Buffer Overflow
Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access.
-
Medium 4.1
Zoom Desktop Client for Linux - Cross Site Scripting
Cross site scripting in Zoom Desktop Client for Linux before version 5.17.10 may allow an authenticated user to conduct a denial of service via network access.
-
Medium 5.5
Zoom Desktop Client for macOS - Improper Privilege Management
Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of privilege via local access.
-
Medium 5.9
Zoom Desktop Client for Windows - Improper Privilege Management
Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access.
-
Medium 5.3
Zoom Rooms Client for Windows - Race Condition
Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
-
Medium 5.4
Zoom Clients - Improper Input Validation
Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access.
-
Medium 6.5
Zoom Clients - Business Logic Error
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
-
Medium 4.9
Zoom Clients - Improper Authentication
Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.
-
Medium 6.8
Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
-
Medium 6.8
Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
-
Medium 6.4
Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial …
-
Medium 4.9
Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before ver…
-
Medium 5.5
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via netw…
-
Medium 4.9
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information d…
-
Medium 4.3
Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of ser…
-
Medium 4.3
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network acces…
-
Medium 4.3
Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow a…
-
Medium 6.5
Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to …
-
Medium 5.9
Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an…
-
Medium 5.5
Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user…
-
Medium 6.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable in…
-
Medium 5.3
Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service …
-
Medium 5.9
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via netwo…
-
Medium 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
-
Medium 4.3
Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potenti…
-
Medium 4.1
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow…
-
Medium 5.2
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to…
-
Medium 4.3
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their di…
-
Medium 6.8
Information Disclosure in Zoom for Windows Clients
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by…
-
Medium 6.5
Denial of Service in Zoom Clients
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
-
Medium 6.5
Denial of Service in Zoom Clients
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
-
Medium 4.4
Insecure key generation for Zoom Rooms for macOS Clients
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local l…
-
Medium 6.1
Path Traversal in Zoom for Android Clients
Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.
-
Medium 6.5
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and vid…
-
Medium 6.5
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting…
-
Medium 6.5
Insufficient Authorization Check During Meeting Join
Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee. As a result, a threat actor in the Zooms waiting room can join the meeting without the consent of the host.
-
Medium 5.9
Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users cli…
-
Medium 5.9
Improperly constrained session cookies in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-sc…
-
Medium 6.5
Process memory exposure in Zoom on-premise Meeting services
A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.