CVE-2022-28763

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-287643.3The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information expos CVE-2022-287667.3Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptib CVE-2022-287687.8The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vul CVE-2022-28775.3The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP addres CVE-2022-287706.1Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a CVE-2022-287717.5Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send maliciou CVE-2022-287727.5By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.CVE-2022-287737.5Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial CVE-2022-287745.5Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.CVE-2022-287753.3Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permi CVE-2022-287767.8Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store wi CVE-2022-287773.3Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without C