Zoom Zoom

Do you want an email whenever new security vulnerabilities are reported in Zoom?

By the Year

In 2023 there have been 1 vulnerability in Zoom with an average score of 7.1 out of ten. Last year Zoom had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Zoom in 2023 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2023 is greater by 1.00.

Year Vulnerabilities Average Score
2023 1 7.10
2022 1 6.10
2021 1 4.30
2020 2 9.30
2019 3 7.27
2018 1 9.80

It may take a day or so for new Zoom vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Zoom Security Vulnerabilities

Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability

CVE-2022-36928 7.1 - High - January 09, 2023

Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.

Directory traversal

The Zoom Client for Meetings (for Android

CVE-2022-28755 6.1 - Medium - August 11, 2022

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.

Open Redirect

Zoom through 5.5.4 sometimes

CVE-2021-28133 4.3 - Medium - March 18, 2021

Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.

Information Disclosure

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets

CVE-2020-6110 8.8 - High - June 08, 2020

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to trigger this vulnerability. For the most severe effect, target user interaction is required.

Directory traversal

An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs

CVE-2020-6109 9.8 - Critical - June 08, 2020

An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to exploit this vulnerability.

Directory traversal

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450

CVE-2019-13567 8.8 - High - July 12, 2019

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.

Shell injection

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs)

CVE-2019-13449 6.5 - Medium - July 09, 2019

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&confno= requests to localhost port 19421.

Improper Input Validation

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers

CVE-2019-13450 6.5 - Medium - July 09, 2019

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.

AuthZ

Zoom clients on Windows (before version 4.1.34814.1119)

CVE-2018-15715 9.8 - Critical - November 30, 2018

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unauthenticated attacker can spoof UDP messages from a meeting attendee or Zoom server in order to invoke functionality in the target client. This allows the attacker to remove attendees from meetings, spoof messages from users, or hijack shared screens.

Improper Input Validation

The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which

CVE-2017-15049 8.8 - High - December 19, 2017

The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.

Shell injection

Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201

CVE-2017-15048 8.8 - High - December 19, 2017

Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.

Buffer Overflow

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Zoom or by Zoom? Click the Watch button to subscribe.

Zoom
Vendor

Zoom
Product

subscribe