311 matches found
Stack overflow
Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure...
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection (CVE-2017-7681), enabling authenticated users to modify query structures and disclose data from other queries. Multiple connected sources confirm the issue and state that it is fixed in version 3.3.0. Affected component: OpenMeetings server...
CVE-2017-7683
Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure...
CVE-2017-7682
Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...
CVE-2017-7680
CVE-2017-7680 affects Apache OpenMeetings 1.0.0. The issue is an overly permissive crossdomain.xml file, allowing flash content to be loaded from untrusted domains. Root cause: crossdomain policy grants loading from external domains, enabling potential cross-domain interactions. Impact is the abi...
CVE-2017-7688
Apache OpenMeetings 1.0.0 updates user password in insecure manner...
CVE-2017-7680
Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains...
CVE-2017-7684
Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server...
CVE-2017-7684
CVE-2017-7684 affects Apache OpenMeetings 1.0.0. The vulnerability arises from not checking the contents of uploaded files, enabling an attacker to cause a Denial of Service by uploading multiple large files. Public sources (NVD, OSV) describe impact as high (CVSS v3 base 7.5) with network access...
CVE-2017-7683
CVE-2017-7683 affects Apache OpenMeetings 1.0.0, where error handling discloses the Tomcat version and a detailed stack trace. This information leakage can aid attackers by revealing server details. The advisory notes the issue is fixed in OpenMeetings 3.3.0; upgrading to >=3.3.0 is the recomm...
CVE-2017-7663
CVE-2017-7663 corresponds to an XSS vulnerability in Apache OpenMeetings 3.2.0, affecting both global and Room chat. The issue is publicly described as a cross-site scripting flaw in the OpenMeetings 3.2.0 release, with remediation noted as a fix in version 3.3.0. The NVD entry lists CVSS scores ...
CVE-2017-7666
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks...
CVE-2017-7682
Summary: Apache OpenMeetings 3.2.0 is described as vulnerable to parameter manipulation attacks, enabling access to restricted areas (CVE-2017-7682). The Connected documents corroborate the same issue across multiple feeds (NVD, GHSA, OSV, CNVD, CNVD, etc.). Affected product/version: OpenMeetings...
CVE-2017-7663
Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0...
CVE-2017-7664
CVE-2017-7664 affects Apache OpenMeetings where uploaded XML documents were not correctly validated in version 3.1.0. The associated advisories indicate this was a remote issue due to missing XML validation, with a remediation noted as upgrading to 3.3.0 (the fix). The NVD metrics show a high bas...
CVE-2017-7685
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...
CVE-2017-7666
CVE-2017-7666 affects Apache OpenMeetings 1.0.0 and exposes CSRF, XSS, click‑jacking, and MIME-based attacks. The issue is addressed in OpenMeetings 3.3.0; remediation is to upgrade to at least 3.3.0. Exploitation details are not provided in the supplied documents.