OP
Product
Openmeetings
29
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 15Medium 9Low 0
Watch
Add Openmeetings to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7681 | 8.8 | Jul 17 | Apache OpenMeetings 1.0.0 is vulnerable to SQL injection Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7666 | 8.8 | Jul 17 | Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7682 | 8.2 | Jul 17 | Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas Affected: 3.2.0; 3.2.1 |
| CVE-2023-29032 | 8.1 | May 12 | An attacker that has gained access to certain private information can use this to act as other user Affected: 3.1.3 before 7.1.0 |
| CVE-2026-33266 | 7.5 | Apr 9 | Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt Affected: 6.1.0 before 9.0.0 |
| CVE-2026-34020 | 7.5 | Apr 9 | Apache OpenMeetings: Login Credentials Passed via GET Query Parameters Affected: 3.1.3 before 9.0.0 |
| CVE-2021-27576 | 7.5 | Mar 15 | If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server Affected: 4.0.0 before 6.0.0 |
| CVE-2020-13951 | 7.5 | Sep 30 | Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack Affected: 4.0.0 through 5.0.0 |
| CVE-2017-7688 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 updates user password in insecure manner Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7684 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7683 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2017-7680 | 7.5 | Jul 17 | Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file Affected: 1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more |
| CVE-2016-2164 | 7.5 | Apr 11 | The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without… Affected: through 3.1.0 |
| CVE-2016-0783 | 7.5 | Apr 11 | The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user… Affected: through 3.1.0 |
| CVE-2023-29246 | 7.2 | May 12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from… Affected: 2.0.0 before 7.1.0 |
Showing 15