CVE-2021-28133

CVSS v3 Score
4.3
Medium
CVSS v2 Score
4.3
Medium

Vulnerability Description

Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.

CVSS:4.3(Medium)

lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.

CVSS:4.3(Medium)

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export

CVSS:4.3(Medium)

Moodle before 2.2.2: Overview report allows users to see hidden courses

CVSS:4.3(Medium)

Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results

CVSS:4.3(Medium)

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.

CVSS:4.3(Medium)

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their ...