OP
Product
Openmeetings
29
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 15Medium 9Low 0
Watch
Add Openmeetings to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7664 | 10.0 | Jul 17 | Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0 Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; +2 more |
| CVE-2024-54676 | 9.8 | Jan 8 | Apache OpenMeetings: Deserialisation of untrusted data in cluster mode Affected: 2.1 before 8.0.0 |
| CVE-2023-28326 | 9.8 | Mar 28 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room Affected: 2.0 before 7.0.0 |
| CVE-2016-8736 | 9.8 | Oct 12 | Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack Affected: before 3.1.2 |
| CVE-2017-7673 | 9.8 | Jul 17 | Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7681 | 8.8 | Jul 17 | Apache OpenMeetings 1.0.0 is vulnerable to SQL injection Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7666 | 8.8 | Jul 17 | Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7682 | 8.2 | Jul 17 | Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas Affected: 3.2.0; 3.2.1 |
| CVE-2023-29032 | 8.1 | May 12 | An attacker that has gained access to certain private information can use this to act as other user Affected: 3.1.3 before 7.1.0 |
| CVE-2026-33266 | 7.5 | Apr 9 | Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt Affected: 6.1.0 before 9.0.0 |
| CVE-2026-34020 | 7.5 | Apr 9 | Apache OpenMeetings: Login Credentials Passed via GET Query Parameters Affected: 3.1.3 before 9.0.0 |
| CVE-2021-27576 | 7.5 | Mar 15 | If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server Affected: 4.0.0 before 6.0.0 |
| CVE-2020-13951 | 7.5 | Sep 30 | Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack Affected: 4.0.0 through 5.0.0 |
| CVE-2017-7688 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 updates user password in insecure manner Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7684 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7683 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7680 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2016-2164 | 7.5 | Apr 11 | The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without… Affected: through 3.1.0 |
| CVE-2016-0783 | 7.5 | Apr 11 | The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user… Affected: through 3.1.0 |
| CVE-2023-29246 | 7.2 | May 12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from… Affected: 2.0.0 before 7.1.0 |
| CVE-2026-49488 | 6.5 | Jul 14 | Apache OpenMeetings: Arbitrary File Read Affected: 5.0.0 before 9.1.0 |
| CVE-2018-1286 | 6.5 | Feb 28 | In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users Affected: 3.0.0 through 4.0.1 |
| CVE-2016-0784 | 6.5 | Apr 11 | Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to… Affected: through 3.1.0 |
| CVE-2017-7663 | 6.1 | Jul 17 | Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0 Affected: 3.2.0; 3.2.1 |
| CVE-2016-3089 | 6.1 | Aug 19 | Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter Affected: through 3.1.1 |
| CVE-2016-2163 | 6.1 | Apr 11 | Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating… Affected: through 3.1.0 |
| CVE-2023-28936 | 5.3 | May 12 | Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 Affected: 2.0.0 before 7.1.0 |
| CVE-2017-7685 | 5.3 | Jul 17 | Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2026-33005 | 4.3 | Apr 9 | Apache OpenMeetings: Insufficient checks in FileWebService Affected: 3.1.0 before 9.0.0 |
Showing 29