Zoom Zero-Day Bug Opens Mac Users to Webcam Hijacking

A zero-day vulnerability in the Zoom client for Mac allows a malicious website to hijack a user’s web camera without their permission. Up to 4 million workers that use the Zoom for Mac web-and videoconferencing service are at risk from a flaw in the collaboration client CVE-2019–13450, according ...

A Zoom Flaw Gives Hackers Easy Access to Your Webcam

All it takes is one wrong click, and the popular video conferencing software will put you in a meeting with a stranger...

Flaw in Zoom Video Conferencing Software Lets Websites Hijack Mac Webcams

If you use Zoom video conferencing software on your Mac computer—then beware—any website you're visiting in your web browser can turn on your device camera without your permission. Ironically, even if you had ever installed the Zoom client on your device and simply uninstalled it, a remote attack...

CVE-2019-13449

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

CVE-2019-13450

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...

CVE-2019-13449

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

CVE-2019-13450

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...

Code injection

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

Directory traversal

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...

CVE-2019-13450

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...

CVE-2019-13450

CVE-2019-13450 affects Zoom Client for macOS up to version 4.4.4 (and RingCentral 7.0.136380.0312) where any web site can interact with the local Zoom Web server on localhost ports 19421/19424, allowing a remote attacker to force a user to join a video call with the camera active. Root cause: ins...

CVE-2019-13449

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

CVE-2019-13449

The CVE-2019-13449 issue affects Zoom Client for macOS prior to 4.4.2, where a remote attacker can trigger a DoS by sending invalid join requests to localhost:19421, causing continual focus grabs and making the client unresponsive. The linked Nessus entry notes later fixes (e.g., 4.4.2 hotfix and...

Zoom Client Information Disclosure Vulnerability

Zoom Client is a video conferencing endpoint from Zoom USA that supports multiple platforms. An information disclosure vulnerability exists in Zoom Client. A remote attacker could force a user to join a video call with the camera active. It is because any website can interact with a zoom web serv...

CVE-2019-13449: Improper Input Validation

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service continual focus grabs via a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

CVE-2019-13450: Missing Authorization

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...

PT-2019-13341

Name of the Vulnerable Software and Affected Versions Zoom Client versions prior to 4.4.4 RingCentral version 7.0.136380.0312 Description The issue allows remote attackers to force a user to join a video call with the video camera active. This is possible because any website can interact with the...

PT-2019-13340

Name of the Vulnerable Software and Affected Versions Zoom Client versions prior to 4.4.2 Description The issue allows remote attackers to cause a denial of service, resulting in continual focus grabs, by sending a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

Zoom Client DOS Vulnerability

Zoom Client is a video conferencing endpoint from Zoom USA that supports multiple platforms. A security vulnerability exists in Zoom Client. A remote attacker could cause a denial of service through a series of invalid starts...

Zoom Client Information Disclosure (Webcam) CVE-2019-13450

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...