Unpatched Critical Flaw Disclosed in Zoom Software for Windows 7 or Earlier

A zero-day vulnerability has been discovered in Zoom video conferencing software for Windows that could allow an attacker to execute arbitrary code on a victim's computer running Microsoft Windows 7 or older. To successfully exploit the zoom vulnerability, all an attacker needs to do is tricking ...

Zoom Client Arbitrary File Write (CVE-2020-6109)

An arbitrary file write vulnerability exists in Zoom Client. Successful exploitation of this vulnerability could result in code execution on the affected system...

CVE-2020-6110

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

CVE-2020-6110

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

CVE-2020-6109

An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a...

Path traversal

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

CVE-2020-6110

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

Zoom Client Path Traversal Vulnerability (CNVD-2020-34131)

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A path traversal vulnerability exists in the way Zoom Client version 4.6.10 handles messages containing shared code segments. An attacker can exploit this vulnerability by sending a specially...

Zoom Client Path Traversal Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A path traversal vulnerability exists in Zoom Client version 4.6.10. An attacker can exploit this vulnerability to execute arbitrary code with the help of a specially crafted message...

Zoom client application chat Giphy arbitrary file write

Summary An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to...

Zoom Client Encryption Issue Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. An encryption issue vulnerability exists in Zoom Client for Meetings version 4.6.11, which stems from the airhost.exe file using 3423423432325249 as the initialization vector IV for AES-256 CBC...

Zoom Client Trust Management Issue Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A trust management issue vulnerability exists in Zoom Client for Meetings version 4.6.11, which stems from the airhost.exe file initializing the SHA-256 hash value of the...

CVE-2020-11877

airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector IV for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code...

CVE-2020-11876

airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE: the vendor states that this initialization only occurs within unreachable code...

CVE-2020-11876

airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE: the vendor states that this initialization only occurs within unreachable code...

Code injection

airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector IV for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code...

Code injection

airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE: the vendor states that this initialization only occurs within unreachable code...

CVE-2020-11876

airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE: the vendor states that this initialization only occurs within unreachable code...

CVE-2020-11876

Zoom Client for Meetings 4.6.11 uses airhost.exe to initialize an OpenSSL EVP AES-256 CBC context via the SHA-256 hash of the string 0123425234234fsdfsdr3242. Vendor states this initialization occurs only in unreachable code. Public Corp/CVE data indicate impact to confidentiality (CVSS3 base 7.5...

CVE-2020-11877

CVE-2020-11877 concerns Zoom Client for Meetings 4.6.11, where the component airhost.exe uses a static IV (3423423432325249) for AES-256 CBC. The Red Hat entry repeats the description and notes the IV is used in unreachable code, meaning exploitation depends on the code path becoming reachable. P...