ZOOM Rooms 安全漏洞

ZOOM Rooms is a software-based conferencing system from the US company Zoom ZOOM. A system that allows web conferencing on fixed endpoints, similar to traditional video conferencing systems.A security vulnerability exists in versions prior to Zoom Rooms for Conference Room for Windows 5.3.0, whic...

Customer Care Giant TTEC Hit By Ransomware

TTEC, NASDAQ: TTEC, a company used by some of the worlds largest brands to help manage customer support and sales online and over the phone, is dealing with disruptions from a network security incident resulting from a ransomware attack, KrebsOnSecurity has learned. While many companies have been...

CVE-2020-19855

phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...

phpwcms 跨站脚本漏洞

phpwcms is a flexible, fast, robust, customer- and developer-friendly and powerful web-based content management system and cms framework based on PHP and MySQL. phpwcms version 1.9 contains a cross-site scripting vulnerability in /imagezoom.php. An attacker can exploit this vulnerability to obtai...

Security News: Exchange ProxyShell, Zoom RCE, Citrix Canceled PT Acknowledgments, Cisco No Patch Router RCEs

Hello everyone! This is a new episode with my comments on the latest Information Security news. Exchange ProxyShell I want to start with something about attacks on Exchange. ProxyShell is in the news, the LockFile ransomware compromised more than 2000 servers. On the other hand, there is basicall...

Zoom Client Heap Based Buffer Overflow (ZSB-22003)

Zoom Client is prone to a heap based buffer overflow vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

(Pwn2Own) Zoom Client GIPHY URL Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zoom Clients. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of GIPHY messages. The issue results from the lack of proper validation of a...

(Pwn2Own) Zoom Heap based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zoom Clients. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of encrypted messages. The issue results from the lack of proper validation ...

Vulnerability fixed in Zoom Client for Meetings

A vulnerability has been fixed in Zoom Client for Meetings. The vulnerability allows a remote malicious person to execute arbitrary code. To exploit this vulnerability exploit two other misconfigurations within the Zoom client while the attacker is is connected to the victim. Zoom indicates that...

(Pwn2Own) Zoom Client Marketplace Use of Incorrectly-Resolved Name or Reference Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zoom Clients. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of Zoom Marketplace URLs. The issue results from the lack of proper...

KLA12359 Heap buffer overflow vulnerability in Zoom

Heap buffer overflow vulnerability was found in Zoom. Malicious users can exploit this vulnerability to execute arbitrary code or cause denial of service. Original advisories Zoom Security Bulletin Related products Zoom-MSI CVE list CVE-2021-30480 unknown Solution Update to the latest version...

PT-2021-5222 · Zoom · Zoom Meeting Sdk For Android +21

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions 5.8.3 and earlier Zoom Client for Meetings for Blackberry versions 5.8.0 and earlier Zoom Client for Meetings for intune versions 5.8.3 and earlier Zoom Client for Meetings for Chrome OS versions 5.0.0 and...

August 10, 2021—KB5005043 (OS Build 14393.4583) - EXPIRED

None None...

A week in security (August 2 – August 8)

Last week on Malwarebytes Labs: RDP brute force attacks explained The 3 biggest threats reaching for your antivirus software’s off switch Zoom and gloom? Video comms org agrees to settle for $85m COVID-19 vaccine appointment system attacked in Italy Chrome casts away the padlock - is it good...

Zoom Settlement: An $85M Business Case for Security Investment

Ransomware isn’t the only way lax security can cost a business eight figures in damage. Zoom just lost an $85 million class-action lawsuit this week for its cybersecurity missteps, proving that even the most essential and relied-upon brands can be tripped up by inadequate security. More...

Zoom Lied about End-to-End Encryption

The facts arent news, but Zoom will pay $85M -- to the class-action attorneys, and to users -- for lying to users about end-to-end encryption, and for giving user data to Facebook and Google without consent. The proposed settlement would generally give Zoom users $15 or $25 each and was filed...

Zoom and gloom? Video comms org agrees to settle for $85m

Zoom has agreed to an $85m settlement regarding privacy, zoom-bombing, and data sharing. The class action privacy lawsuit filed in the US against the embattled company wasn’t particularly impressed with the following: Zoom-bombing running wild in video sessions. Zoom-bombing, the practice of...

CVE-2021-24447

The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard...

CVE-2021-24447

The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard...

Design/Logic Flaw

The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard...