CVE-2020-6109

An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a...

CVE-2020-6109

CVE-2020-6109 affects Zoom Client prior to 4.6.12 (notably 4.6.10) where a crafted chat message can trigger a path traversal in message processing, allowing arbitrary file write and potential code execution. The vulnerability exists when processing messages (including animated GIFs) sent by a rem...

Tangalanga - The Zoom Conference Scanner Hacking Tool

Zoom Conference scanner. This scanner will check for a random meeting id and return information if available. Usage This are all the possible flags: tangalanga \ -token=user-token \ default: env TOKEN user token to use. -colors=false \ default: true enable/disable colors -censor=true \ default:...

News Wrap: Fake Minneapolis Police Breach, Zoom End-To-End Encryption Debate

Threatpost editors Lindsey O’Donnell-Welch and Tara Seals discuss the top security news stories of the week, including: Reports emerged earlier this week that the Minneapolis police department had been breached by hacktivist group Anonymous. Security expert Troy Hunt debunked the reports, however...

This Week in Security News: Google Faces Privacy Lawsuit Over Tracking Users in Incognito Mode and TrickBot Adds Enterprise-grade Module to Malware Arsenal

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about a new module for the infamous trojan known as TrickBot that has been deployed. Also, read about Google’s $5 billion class-action...

Zoom Restricts End-to-End Encryption to Paid Users

Security experts are up in arms after learning that video conferencing app Zoom will only offer end-to-end encryption to paid users. On Zoom’s Wednesday first-quarter financial earnings call, Zoom CEO Eric Yuang said that the upcoming end-to-end encryption feature would not apply for free users...

Zoom's Commitment to User Security Depends on Whether you Pay It or Not

Zoom was doing so well.... And now we have this: Corporate clients will get access to Zoom's end-to-end encryption service now being developed, but Yuan said free users won't enjoy that level of privacy, which makes it impossible for third parties to decipher communications. "Free users for sure ...

Zoom Client Path Traversal Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A path traversal vulnerability exists in Zoom Client version 4.6.10. An attacker can exploit this vulnerability to execute arbitrary code with the help of a specially crafted message...

Zoom Client Path Traversal Vulnerability (CNVD-2020-34131)

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A path traversal vulnerability exists in the way Zoom Client version 4.6.10 handles messages containing shared code segments. An attacker can exploit this vulnerability by sending a specially...

Zoom's End-to-End Encryption Will Be for Paying Customers Only

The videoconferencing company says it wants to be able to work with law enforcement to catch bad actors on its platform...

Two Critical Flaws in Zoom Could've Let Attackers Hack Systems via Chat

If you're using Zoom—especially during this challenging time to cope with your schooling, business, or social engagement—make sure you are running the latest version of the widely popular video conferencing software on your Windows, macOS, or Linux computers. No, it's not about the arrival of the...

Two Critical Flaws in Zoom Could've Let Attackers Hack Systems via Chat

If you're using Zoom —especially during this challenging time to cope with your schooling, business, or social engagement—make sure you are running the latest version of the widely popular video conferencing software on your Windows, macOS, or Linux computers. No, it's not about the arrival of th...

Vulnerability Spotlight: Two vulnerabilities in Zoom could lead to code execution

A member of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered two vulnerabilities in the popular Zoom video chatting application that could allow a malicious user to execute arbitrary code on victims’ machines. Video conferencing software has...

Zoom Client Application Chat Code Snippet Remote Code Execution Vulnerability

Summary An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacke...

Zoom client application chat Giphy arbitrary file write

Summary An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to...

KLA11803 Path traversal vulnerabilities in Zoom

Path traversal vulnerabilities were found in Zoom. Malicious users can exploit this vulnerabilities to execute arbitrary code. Original advisories Talos Blog for Zoom CVE-2020-6109 CVE-2020-6110 Related products Zoom-MSI CVE list CVE-2020-6109 critical CVE-2020-6110 high Solution Update to the...

A week in security (May 25 – 31)

Last week on Malwarebytes Labs, we published our most recent episode of our podcast Lock and Code, providing an in-depth discussion on web browser privacy, looked at the membership bump for the Coalition against Stalkerware, and dug into EDR solutions. We also looked at twists added to the threat...

This Week in Security News: New Bluetooth Vulnerability Exposes Billions of Devices to Hackers and Backdoor, Devil Shadow Botnet Hidden in Fake Zoom Installers

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read about a new security vulnerability in Bluetooth that could potentially allow an attacker to spoof a remotely paired device. Also, learn...

Zoom Security Gets a Boost With Keybase Acquisition

Plus: A GoDaddy breach, a ransomware attack, and more of the week's top security news...

Zoom Beefs Up End-to-End Encryption to Thwart 'Zoombombers'

Video calling platform Zoom is boosting its security profile via the acquisition of a small startup called Keybase. The 25-person, New York-based company will provide more robust encryption for Zoom calls on paid subscriptions by implementing an end-to-end architecture. “Logged-in users will...