Apache OpenMeetings Directory Traversal vulnerability

Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. dot dot in a ZIP archive entry...

Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

The 1 FileService.importFileByInternalUserId and 2 FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file...

GHSA-F6VF-465R-H42P Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

The 1 FileService.importFileByInternalUserId and 2 FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file...

Apache OpenMeetings Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event...

GHSA-GW38-MXR2-RM8R Apache OpenMeetings Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event...

GHSA-633W-W2PF-X84R Apache OpenMeetings Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter...

Apache OpenMeetings Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter...

Apache OpenMeetings RCE

Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack...

GHSA-6CPG-3W7F-J67Q Apache OpenMeetings RCE

Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack...

Apache OpenMeetings may allow authenticated attacker to deny service for privileged users

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. The issue is fixed in version 4.0.2...

GHSA-CV9J-7Q4X-V2G2 Apache OpenMeetings may allow authenticated attacker to deny service for privileged users

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. The issue is fixed in version 4.0.2...

Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption

Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server...

GHSA-G3VQ-F35V-VHGM Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption

Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server...

Apache OpenMeetings responds to insecure HTTP methods

Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...

GHSA-XHJ7-JR45-5W8R Apache OpenMeetings updates user password in insecure manner

Apache OpenMeetings 1.0.0 updates user password in insecure manner. This issue is fixed in version 3.3.0...

Apache OpenMeetings updates user password in insecure manner

Apache OpenMeetings 1.0.0 updates user password in insecure manner. This issue is fixed in version 3.3.0...

GHSA-2C3P-9J5F-33G3 Apache OpenMeetings responds to insecure HTTP methods

Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...

GHSA-CQM6-HRGQ-6869 Apache OpenMeetings has Inadequate Encryption Strength

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

Apache OpenMeetings allows flash content to be loaded from untrusted domains

Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains...

GHSA-2Q65-XXG6-3QH5 Apache OpenMeetings vulnerable to parameter manipulation attacks

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...