Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to ...
7.1CVSS
6.1AI Score
0.001EPSS
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
4.3CVSS
4.7AI Score
0.001EPSS
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
6.5CVSS
6.4AI Score
0.001EPSS
4.1CVSS
4.4AI Score
0.0004EPSS
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.
8.8CVSS
8.7AI Score
0.001EPSS