PT-2016-5041

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions prior to 3.1.1 Description The issue is related to the improper use of the Java URL class in the FileService.importFileByInternalUserId and FileService.importFile SOAP API methods. This allows remote attackers to...

CVE-2016-2164: Exposure of Sensitive Information to an Unauthorized Actor

The 1 FileService.importFileByInternalUserId and 2 FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file...