CVE-2018-15715
published 2018-11-30CVE-2018-15715: Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to…
PriorityP260critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.49%
88.6th percentile
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unauthenticated attacker can spoof UDP messages from a meeting attendee or Zoom server in order to invoke functionality in the target client. This allows the attacker to remove attendees from meetings, spoof messages from users, or hijack shared screens.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zoom | zoom | < 4.1.34801.1116 | 4.1.34801.1116 |
| zoom | zoom | < 4.1.34814.1119 | 4.1.34814.1119 |
| zoom | zoom | <= 2.4.129780.0915 | — |
| zoom | zoom | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gf85-hm2v-6785: Zoom clients on Windows (before version 4
ghsa_unreviewed·2022-05-13
CVE-2018-15715 [CRITICAL] CWE-20 GHSA-gf85-hm2v-6785: Zoom clients on Windows (before version 4
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unauthenticated attacker can spoof UDP messages from a meeting attendee or Zoom server in order to invoke functionality in the target client. This allows the attacker to remove attendees from meetings, spoof messages from users, or hijack shared screens.
OSV
apache2 vulnerabilities
osv·2018-04-19·CVSS 7.5
CVE-2017-15710 apache2 vulnerabilities
apache2 vulnerabilities
Alex Nichols and Jakob Hirsch discovered that the Apache HTTP Server
mod_authnz_ldap module incorrectly handled missing charset encoding
headers. A remote attacker could possibly use this issue to cause the
server to crash, resulting in a denial of service. (CVE-2017-15710)
Elar Lang discovered that the Apache HTTP Server incorrectly handled
certain characters specified in . A remote attacker could
possibly use this issue to upload certain files, contrary to expectations.
(CVE-2017-15715)
It was discovered that the Apache HTTP Server mod_session module
incorrectly handled certain headers. A remote attacker could possibly use
this issue to influence session data. (CVE-2018-1283)
Robert Swiecki discovered that the Apache HTTP Server incorrectly handled
certain req
No detection rules found.
No public exploits indexed.
Tenable
Zoom Patches Multiple Flaws and Responds to Security and Privacy Concerns
blogs_tenable·2020-04-03
Zoom Patches Multiple Flaws and Responds to Security and Privacy Concerns
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Unauthorized Call and Webcam Access Vulnerability in Zoom Mac Client (CVE-2019-13450)
blogs_tenable·2019-07-10·CVSS 6.5
[MEDIUM] Unauthorized Call and Webcam Access Vulnerability in Zoom Mac Client (CVE-2019-13450)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Tenable Research Advisory: Zoom Unauthorized Command Execution (CVE-2018-15715)
blogs_tenable·2018-11-29·CVSS 9.8
[CRITICAL] Tenable Research Advisory: Zoom Unauthorized Command Execution (CVE-2018-15715)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Tenable Research Discovers Vulnerability in Zoom that Could Lead to Conference Hijacking
blogs_tenable·2018-11-29·CVSS 9.8
CVE-2018-15715 [CRITICAL] Tenable Research Discovers Vulnerability in Zoom that Could Lead to Conference Hijacking
## Tenable Research Discovers Vulnerability in Zoom that Could Lead to Conference Hijacking
November 29, 2018
·
Columbia, MD
The flaw could potentially allow a threat actor to take control of a victim’s desktop to download and execute malware
Tenable®, Inc. , the Cyber Exposure company, today announced that its research team has discovered a serious vulnerability in Zoom’s Desktop Conferencing Application [CVE-2018-15715] that would allow a remote attacker or rogue meeting attendee to hijack screen controls, impersonate meeting attendees via chat messages and kick attendees out of meetings. The flaw exposes up to 750,000 companies around the world that use Zoom to conduct day-to-day business.
As digital transformation surges and remote workforces become increasingly common, conferencin
2018-11-30
Published