Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

29 records

Vendor: Apache Component: Openmeetings Clear all filters
TI-2026-36638 CVE-2026-49488 · GHSA-436m-m73c-vq4g

Apache OpenMeetings: Arbitrary File Read

Priority LOW 30

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00703 Published 2026-07-14 Fixed in 9.1.0 CWE-22
TI-2024-36639 CVE-2024-54676 · GHSA-mjf9-4pcv-vfg7

Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

Priority CRITICAL 86

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68777 Published 2025-01-08 Fixed in 8.0.0 CWE-502
TI-2023-13413 CVE-2023-28936 · GHSA-v93h-rwj8-78qh

Apache OpenMeetings: insufficient check of invitation hash

Priority LOW 32

Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01204 Published 2023-05-12 Fixed in 7.1.0 CWE-697
TI-2023-13492 CVE-2023-29032 · GHSA-v9rm-7rv9-r3fw

Apache OpenMeetings: allows bypass authentication

Priority LOW 39

An attacker that has gained access to certain private information can use this to act as other user.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01093 Published 2023-05-12 Fixed in 7.1.0 CWE-287
TI-2023-13658 CVE-2023-29246 · GHSA-mg5h-f3q8-c96g

Apache OpenMeetings: allows null-byte Injection

Priority LOW 37

An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01464 Published 2023-05-12 Fixed in 7.1.0 CWE-20
TI-2023-12874 CVE-2023-28326 · GHSA-3r48-3m8r-4r9w

Apache OpenMeetings: allows user impersonation

Priority MEDIUM 51

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01262 Published 2023-03-28 Fixed in 7.0.0 CWE-306
TI-2018-01191 CVE-2018-1286 · GHSA-cv9j-7q4x-v2g2

Improper authentication in Apache OpenMeetings

Priority LOW 31

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01085 Published 2018-02-28 Fixed in 4.0.2 CWE-287
TI-2017-05317 CVE-2017-7681 · GHSA-335g-xcjh-ghc2

SQL injection in Apache OpenMeetings

Priority MEDIUM 41

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01285 Published 2017-07-14 Fixed in 3.3.0 CWE-89
TI-2017-05309 CVE-2017-7673 · GHSA-cqm6-hrgq-6869

Missing brute-force protection in Apache OpenMeetings

Priority MEDIUM 45

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01647 Published 2017-07-14 Fixed in 3.3.0 CWE-307
TI-2017-05302 CVE-2017-7666 · GHSA-m5pm-rgvf-vg22

Cross-site request forgery in Apache OpenMeetings

Priority MEDIUM 40

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00804 Published 2017-07-14 Fixed in 3.3.0 CWE-352
Load more