Openmeetings
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Openmeetings (6384b10a-0213-5c20-b422-f8a7e22e933b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/openmeetings |
purl2cpe | 2026-06-01 10:14:32.753423 |
pkg:docker/apache/openmeetings |
purl2cpe | 2026-06-01 10:14:32.753426 |
pkg:github/apache/openmeetings |
purl2cpe | 2026-06-01 10:14:32.753429 |
pkg:maven/org.apache.openmeetings/openmeetings-parent |
purl2cpe | 2026-06-01 10:14:32.753431 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-34020 |
vulnerable | 2026-06-08 07:59:11.692844 |
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Published: 2026-04-09T15:52:06.599Z
Updated: 2026-04-10T20:13:47.789Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33266 |
vulnerable | 2026-06-08 07:59:09.455318 |
Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.
The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.
This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Published: 2026-04-09T15:52:36.105Z
Updated: 2026-04-10T18:49:13.351Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33005 |
vulnerable | 2026-06-08 07:57:18.450425 |
Apache OpenMeetings: Insufficient checks in FileWebService
Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.
Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.
This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Published: 2026-04-09T15:52:50.770Z
Updated: 2026-04-10T18:44:45.976Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54676 |
vulnerable | 2026-06-08 06:54:16.749164 |
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
Vendor: The Apache Software Foundation
Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0
Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.
Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.
Published: 2025-01-08T08:40:03.705Z
Updated: 2025-01-08T14:00:52.923Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29246 |
vulnerable | 2026-06-08 06:02:39.191944 |
Apache OpenMeetings: allows null-byte Injection
An attacker who has gained access to an admin account can perform RCE via null-byte injection
Vendor: The Apache Software Foundation
Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Published: 2023-05-12T07:43:20.422Z
Updated: 2024-10-10T19:35:57.172Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29032 |
vulnerable | 2026-06-08 06:02:37.959100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28936 |
vulnerable | 2026-06-08 06:02:36.659865 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28326 |
vulnerable | 2026-06-08 06:01:10.356357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27576 |
vulnerable | 2026-06-08 05:31:21.795102 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13951 |
vulnerable | 2026-06-08 05:18:01.597598 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1286 |
vulnerable | 2026-06-08 05:11:17.480514 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8736 |
vulnerable | 2026-06-08 05:08:14.746696 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-3089 |
vulnerable | 2026-06-08 05:07:44.359240 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2164 |
vulnerable | 2026-06-08 05:07:33.467396 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2163 |
vulnerable | 2026-06-08 05:07:33.466949 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0784 |
vulnerable | 2026-06-08 05:07:16.297357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0783 |
vulnerable | 2026-06-08 05:07:16.296858 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.