Vulnerabilidades em Zoom Video Communications, Inc.

65 resultados
Análise Vexday

O portfólio de vulnerabilidades do Zoom Video Communications apresenta um perfil de risco relativamente contido no momento: nenhuma CVE consta no catálogo KEV da CISA, taxa abaixo da média geral do catálogo, e não há registros de provas de conceito públicas ou novas vulnerabilidades nos últimos 90 dias. Das 65 CVEs catalogadas, 4 são de severidade crítica, e o tipo de falha mais recorrente é CWE-426 (Uncontrolled Search Path Element), que pode permitir elevação de privilégios por meio de binários maliciosos em caminhos controlados pelo atacante — uma classe de vulnerabilidade que exige atenção especial em ambientes corporativos Windows. A CVE mais relevante no momento, CVE-2024-24691, apresenta EPSS de 0,0169, indicando probabilidade de exploração ainda baixa, mas suficiente para justificar priorização em ciclos regulares de patching. O cenário atual sugere ausência de ameaça imediata massiva, porém a presença de falhas críticas e a natureza do CWE dominante recomendam manutenção rigorosa das atualizações e controle de integridade de executáveis no ambiente.

CVE-2024-24691CRITICALZoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input ValidationEPSS 1.7%CVE-2024-24699MEDIUMZoom Clients - Business Logic ErrorEPSS 1.7%CVE-2023-36534CRITICALPath traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via nEPSS 1.4%CVE-2023-39217MEDIUMImproper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.EPSS 1.3%CVE-2023-39213CRITICALImproper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticateEPSS 1.3%CVE-2023-36532MEDIUMBuffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.EPSS 1.3%CVE-2023-39206LOWBuffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.EPSS 1.1%CVE-2023-39204MEDIUMBuffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.EPSS 1.1%CVE-2023-39216CRITICALImproper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privEPSS 1.1%CVE-2023-36535HIGHClient-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosEPSS 1.0%CVE-2023-43586HIGHPath traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user toEPSS 1.0%CVE-2023-34114HIGHExposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potenEPSS 1.0%CVE-2023-34116HIGHImproper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalatioEPSS 1.0%CVE-2023-28601HIGHZoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. EPSS 1.0%CVE-2023-34121MEDIUMImproper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated EPSS 1.0%CVE-2023-39218MEDIUMClient-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure EPSS 0.9%CVE-2023-39203MEDIUMUncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated useEPSS 0.9%CVE-2023-39215HIGHImproper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.EPSS 0.9%CVE-2023-39205MEDIUMImproper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network acceEPSS 0.9%CVE-2023-39214HIGHExposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via netwoEPSS 0.8%