CVE-2019-13449

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&confno= requests to localhost port 19421.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdfVendor Advisory
https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/Vendor Advisory
https://bugs.chromium.org/p/chromium/issues/detail?id=951540Exploit, Third Party Advisory
https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
https://twitter.com/zoom_us/status/1148710712241295361Third Party Advisory
https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdfVendor Advisory
https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/Vendor Advisory
https://bugs.chromium.org/p/chromium/issues/detail?id=951540Exploit, Third Party Advisory
https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
https://twitter.com/zoom_us/status/1148710712241295361Third Party Advisory

Timeline

Published: Jul 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-13455.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information CVE-2019-134506.5In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the v CVE-2019-134519.8In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c.CVE-2019-134529.8In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c.CVE-2019-134536.5Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. T CVE-2019-134546.5ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.CVE-2019-134559.8In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of   expansion CVE-2019-134566.5In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 CVE-2019-134574.3An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose inf CVE-2019-134586.5An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x throu CVE-2019-13466.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. T CVE-2019-134617.5In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Refere