Pexip security bulletins

The following security bulletins are published by Pexip for issues affecting our own products — Pexip Infinity, the Pexip apps, the VMR self-service portal, Enhanced Room Management and the AI Media Server (AIMS). There are currently no security bulletins for any other Pexip products, including the Reverse Proxy and TURN Server or Pexip Justice.

For information about external issues arising in third-party software and operating systems that may impact these Pexip products, see https://www.pexip.com/trust-center. Where relevant, updates will be incorporated into each Pexip product, so we recommend that you frequently check for and always run the latest versions of each product. If you have deployed Pexip's VMR self-service portal, Reverse Proxy and TURN Server or Pexip Justice products, you should also ensure that the appliance's operating system is regularly patched against the latest security bugs.

More information specific for each of the vulnerabilities can be found via the NIST National Vulnerability Database: http://nvd.nist.gov/.

Pexip Infinity

This list covers issues addressed in Pexip Infinity v35.0 and later. For issues addressed in v34.x or earlier, see our documentation for previous releases.

Each bulletin addresses a number of vulnerabilities in the operating system software used by Pexip Infinity. The bulletins include an assessment of the issues, the impact to the Pexip Infinity platform, and resolution details.

In the table below, "Severity" reflects the severity of the issue as calculated from the CVSS Base Score. "Risk" reflects the risk associated with each vulnerability in the context of the Pexip Infinity product environment.

Reference Description Severity Risk Updated Impacted versions Addressed in version
CVE-2025-59683

Improper access control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens, allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.

CVSS3.1 base score: 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

Mitigation: Customers using Office 365 and are running Pexip Infinity Version 37.1 or newer should ensure that all of their Secure Scheduler for Exchange integrations are using an "Add-in authentication token type" of "SSO Token" or "NAA (Nested App Authentication) Token".

Resolution: Upgrade to Pexip Infinity v38.1

 High High October 2025 15.0 - 38.0 38.1
CVE-2025-48704

Insufficient input validation in the signalling implementation(s) allows a malicious attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v38

 High High July 2025 35.0 - 37.2 38.0
CVE-2025-24855

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

CVSS 3.1 base score: 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)

Discussion: Infinity versions before 27 do not expose this component to untrusted input and are thus not directly impacted by this issue (although it is still present in the versions of the component contained in pre-27 Infinity releases). Infinity versions from 27 up to 38 do process untrusted input using the affected component as part of the Single Sign-On functionality.

Mitigation: Administrators should ensure that only trusted Identity Providers are configured.

Resolution: Upgrade to Pexip Infinity v38.

 High High July 2025 All before 38.0 38.0
CVE-2024-55549

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.

CVSS3.1 base score: 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)

Discussion: Infinity versions before 27 do not expose this component to untrusted input and are thus not directly impacted by this issue (although it is still present in the versions of the component contained in pre-27 Infinity releases). Infinity versions from 27 up to 38 do process untrusted input using the affected component as part of the Single Sign-On functionality.

Mitigation: Administrators should ensure that only trusted Identity Providers are configured.

Resolution: Upgrade to Pexip Infinity v38.

 High High July 2025 All before v38.0 38.0
Multiple Resolved minor issues: CVE-2011-10007, CVE-2022-49043, CVE-2023-29383, CVE-2023-4039, CVE-2023-4641, CVE-2023-48795, CVE-2023-51385, CVE-2023-51767, CVE-2024-56171, CVE-2024-56406, CVE-2024-7347, CVE-2025-0938, CVE-2025-1390, CVE-2025-22247, CVE-2025-22866, CVE-2025-22870, CVE-2025-24928, CVE-2025-26699, CVE-2025-27113, CVE-2025-31115, CVE-2025-32415, CVE-2025-32728, CVE-2025-32873, CVE-2025-4207, CVE-2025-4598, CVE-2025-46836, CVE-2025-48432, CVE-2025-6199     July 2025   38.0
CVE-2025-49088

Insufficient input validation in the One Touch Join service allows a remote attacker to trigger a software abort leading to a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Discussion: A crafted calendar invite allows a remote attacker to trigger a software abort.

Mitigation: This vulnerability requires the configuration of an OTJ Profile, an associated OTJ Endpoint Group which contains at least one OTJ Endpoint, and an associated OTJ Meeting Processing Rule of type "Microsoft Teams SIP Guest Join". The attacker needs to be able to send a calendar invite to the OTJ Endpoint Room resource email. For OTJ Exchange and OTJ Graph Integrations, it is possible to set the ProcessExternalMeetingMessages flag to $false, which will cause meeting requests from external senders to be rejected.

Resolution: Upgrade to Pexip Infinity 37.2

 High High June 2025 32.0 - 37.1 37.2
CVE-2025-32096

Insufficient input validation in the signaling implementation(s) allows a malicious attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity 37.1

 High High May 2025 33.0 - 37.0 37.1
CVE-2025-32095

Insufficient input validation in the signalling implementation(s) allows a remote attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Discussion: A crafted signalling message allows a remote attacker to trigger a software abort.

Mitigation: None

Resolution: Upgrade to Pexip Infinity v37.0

 High High March 2025 All before 37.0 37.0
CVE-2025-30080

Insufficient input validation in the signalling implementation(s) allows a malicious attacker to trigger a software abort resulting in a temporary denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v37.0

 High High March 2025 29 - 36.2 37.0
CVE-2024-12084

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

CVSS 3.1 base score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Discussion: Exploitation of this vulnerability requires access to the operating system on an Infinity node as the rsync daemon is not exposed to the network outside the Infinity deployment. Therefore, the risk to Infinity is reduced from Critical to High.

Mitigation: Ensure only trusted users have operating system access to the Infinity deployment.

Resolution: Upgrade to Pexip Infinity v37.0

 Critical High March 2025 All before 37.0 37.0
Multiple Resolved minor issues: CVE-2023-0187, CVE-2023-0188, CVE-2023-0190, CVE-2023-0194, CVE-2023-0195, CVE-2023-0199, CVE-2023-28370, CVE-2023-31022, CVE-2023-31124, CVE-2023-31147, CVE-2023-49081, CVE-2023-49082, CVE-2023-52920, CVE-2024-0075, CVE-2024-0078, CVE-2024-0092, CVE-2024-5197, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, CVE-2024-12747, CVE-2024-25629, CVE-2024-26686, CVE-2024-27011, CVE-2024-27017, CVE-2024-36478, CVE-2024-41810, CVE-2024-43835, CVE-2024-45336, CVE-2024-45341, CVE-2024-46678, CVE-2024-46679, CVE-2024-46695, CVE-2024-46711, CVE-2024-46713, CVE-2024-46717, CVE-2024-46721, CVE-2024-46735, CVE-2024-46737, CVE-2024-46738, CVE-2024-46739, CVE-2024-46744, CVE-2024-46746, CVE-2024-46750, CVE-2024-46762, CVE-2024-46763, CVE-2024-46777, CVE-2024-46782, CVE-2024-46783, CVE-2024-46784, CVE-2024-46787, CVE-2024-46794, CVE-2024-46800, CVE-2024-46826, CVE-2024-46828, CVE-2024-46829, CVE-2024-46830, CVE-2024-46848, CVE-2024-46855, CVE-2024-46858, CVE-2024-47660, CVE-2024-47668, CVE-2024-47674, CVE-2024-47678, CVE-2024-47679, CVE-2024-47682, CVE-2024-47684, CVE-2024-47685, CVE-2024-47693, CVE-2024-47701, CVE-2024-47705, CVE-2024-47706, CVE-2024-47707, CVE-2024-47710, CVE-2024-47727, CVE-2024-47728, CVE-2024-47734, CVE-2024-47739, CVE-2024-47742, CVE-2024-47743, CVE-2024-47745, CVE-2024-47748, CVE-2024-49568, CVE-2024-49850, CVE-2024-49851, CVE-2024-49855, CVE-2024-49856, CVE-2024-49858, CVE-2024-49860, CVE-2024-49861, CVE-2024-49863, CVE-2024-49870, CVE-2024-49878, CVE-2024-49881, CVE-2024-49882, CVE-2024-49883, CVE-2024-49884, CVE-2024-49889, CVE-2024-49925, CVE-2024-49926, CVE-2024-49927, CVE-2024-49933, CVE-2024-49934, CVE-2024-49935, CVE-2024-49948, CVE-2024-49949, CVE-2024-49952, CVE-2024-49954, CVE-2024-49959, CVE-2024-49960, CVE-2024-49973, CVE-2024-49975, CVE-2024-49978, CVE-2024-49983, CVE-2024-49994, CVE-2024-50000, CVE-2024-50001, CVE-2024-50002, CVE-2024-50006, CVE-2024-50009, CVE-2024-50010, CVE-2024-50012, CVE-2024-50013, CVE-2024-50014, CVE-2024-50015, CVE-2024-50019, CVE-2024-50022, CVE-2024-50024, CVE-2024-50036, CVE-2024-50038, CVE-2024-50039, CVE-2024-50045, CVE-2024-50046, CVE-2024-50048, CVE-2024-50055, CVE-2024-50058, CVE-2024-50060, CVE-2024-50063, CVE-2024-50067, CVE-2024-50082, CVE-2024-50083, CVE-2024-50093, CVE-2024-50095, CVE-2024-50110, CVE-2024-50115, CVE-2024-50126, CVE-2024-50127, CVE-2024-50131, CVE-2024-50135, CVE-2024-50141, CVE-2024-50142, CVE-2024-50143, CVE-2024-50147, CVE-2024-50153, CVE-2024-50154, CVE-2024-50162, CVE-2024-50163, CVE-2024-50164, CVE-2024-50182, CVE-2024-50184, CVE-2024-50185, CVE-2024-50189, CVE-2024-50191, CVE-2024-50195, CVE-2024-50199, CVE-2024-50200, CVE-2024-50211, CVE-2024-50226, CVE-2024-50250, CVE-2024-50251, CVE-2024-50256, CVE-2024-50257, CVE-2024-50258, CVE-2024-50261, CVE-2024-50262, CVE-2024-50264, CVE-2024-50271, CVE-2024-50272, CVE-2024-50278, CVE-2024-50279, CVE-2024-50280, CVE-2024-50301, CVE-2024-50302, CVE-2024-50304, CVE-2024-52533, CVE-2024-53042, CVE-2024-53052, CVE-2024-53057, CVE-2024-53079, CVE-2024-53082, CVE-2024-53085, CVE-2024-53091, CVE-2024-53093, CVE-2024-53099, CVE-2024-53105, CVE-2024-53124, CVE-2024-53125, CVE-2024-53128, CVE-2024-53141, CVE-2024-53142, CVE-2024-53164, CVE-2024-53166, CVE-2024-53170, CVE-2024-53175, CVE-2024-53194, CVE-2024-53198, CVE-2024-53214, CVE-2024-53224, CVE-2024-53233, CVE-2024-53240, CVE-2024-53241, CVE-2024-53907, CVE-2024-53908, CVE-2024-54683, CVE-2024-56374, CVE-2024-56566, CVE-2024-56569, CVE-2024-56570, CVE-2024-56583, CVE-2024-56584, CVE-2024-56587, CVE-2024-56592, CVE-2024-56600, CVE-2024-56601, CVE-2024-56606, CVE-2024-56611, CVE-2024-56614, CVE-2024-56615, CVE-2024-56631, CVE-2024-56633, CVE-2024-56636, CVE-2024-56637, CVE-2024-56640, CVE-2024-56641, CVE-2024-56644, CVE-2024-56658, CVE-2024-56662, CVE-2024-56664, CVE-2024-56672, CVE-2024-56675, CVE-2024-56693, CVE-2024-56703, CVE-2024-56709, CVE-2024-56718, CVE-2024-56720, CVE-2024-56739, CVE-2024-56745, CVE-2024-56751, CVE-2024-56756, CVE-2024-56763, CVE-2024-56770, CVE-2024-56780, CVE-2024-56786, CVE-2024-57843, CVE-2024-57882, CVE-2024-57883, CVE-2024-57884, CVE-2024-57888, CVE-2024-57890, CVE-2024-57900, CVE-2024-57903, CVE-2024-57917, CVE-2024-57924, CVE-2024-57929, CVE-2024-57931, CVE-2024-57940, CVE-2025-21648, CVE-2025-21653, CVE-2025-21664, CVE-2025-21665, CVE-2025-21666, CVE-2025-21667, CVE-2025-21669, CVE-2025-21680, CVE-2025-21681, CVE-2025-21683, CVE-2025-21700, CVE-2025-21701     March 2025   37.0
Multiple Resolved minor issues: CVE-2023-3019, CVE-2023-3301, CVE-2023-52596, CVE-2023-52619, CVE-2023-52621, CVE-2023-52622, CVE-2023-52889, CVE-2023-6683, CVE-2024-2004, CVE-2024-2398, CVE-2024-24789, CVE-2024-2511, CVE-2024-26327, CVE-2024-26328, CVE-2024-26581, CVE-2024-26601, CVE-2024-26602, CVE-2024-26603, CVE-2024-26621, CVE-2024-26622, CVE-2024-26626, CVE-2024-26627, CVE-2024-26640, CVE-2024-26641, CVE-2024-26642, CVE-2024-26643, CVE-2024-26665, CVE-2024-26671, CVE-2024-26673, CVE-2024-26676, CVE-2024-26679, CVE-2024-26687, CVE-2024-26688, CVE-2024-26698, CVE-2024-26704, CVE-2024-26718, CVE-2024-26720, CVE-2024-26731, CVE-2024-26733, CVE-2024-26735, CVE-2024-26737, CVE-2024-26739, CVE-2024-26740, CVE-2024-26759, CVE-2024-26760, CVE-2024-26761, CVE-2024-26763, CVE-2024-26764, CVE-2024-26769, CVE-2024-26772, CVE-2024-26773, CVE-2024-26774, CVE-2024-26775, CVE-2024-26782, CVE-2024-26783, CVE-2024-26798, CVE-2024-26803, CVE-2024-26804, CVE-2024-26805, CVE-2024-26809, CVE-2024-26810, CVE-2024-26812, CVE-2024-26815, CVE-2024-26816, CVE-2024-26835, CVE-2024-26840, CVE-2024-26844, CVE-2024-26845, CVE-2024-26851, CVE-2024-26852, CVE-2024-26857, CVE-2024-26862, CVE-2024-26865, CVE-2024-26878, CVE-2024-26880, CVE-2024-26882, CVE-2024-26883, CVE-2024-26884, CVE-2024-26885, CVE-2024-26891, CVE-2024-26894, CVE-2024-26898, CVE-2024-26900, CVE-2024-26901, CVE-2024-26906, CVE-2024-26907, CVE-2024-26920, CVE-2024-26921, CVE-2024-26923, CVE-2024-26924, CVE-2024-26925, CVE-2024-26935, CVE-2024-26953, CVE-2024-26960, CVE-2024-26976, CVE-2024-26983, CVE-2024-26987, CVE-2024-26988, CVE-2024-26992, CVE-2024-26993, CVE-2024-27013, CVE-2024-27014, CVE-2024-27015, CVE-2024-27016, CVE-2024-27019, CVE-2024-27020, CVE-2024-27022, CVE-2024-27024, CVE-2024-27047, CVE-2024-27065, CVE-2024-27389, CVE-2024-27393, CVE-2024-27403, CVE-2024-27415, CVE-2024-27437, CVE-2024-31076, CVE-2024-3447, CVE-2024-35255, CVE-2024-35803, CVE-2024-35860, CVE-2024-35875, CVE-2024-35904, CVE-2024-35929, CVE-2024-35939, CVE-2024-35945, CVE-2024-35947, CVE-2024-35961, CVE-2024-35974, CVE-2024-35995, CVE-2024-36000, CVE-2024-36017, CVE-2024-36028, CVE-2024-36244, CVE-2024-36270, CVE-2024-36286, CVE-2024-36489, CVE-2024-36881, CVE-2024-36882, CVE-2024-36883, CVE-2024-36889, CVE-2024-36890, CVE-2024-36891, CVE-2024-36901, CVE-2024-36902, CVE-2024-36903, CVE-2024-36904, CVE-2024-36905, CVE-2024-36908, CVE-2024-36909, CVE-2024-36910, CVE-2024-36911, CVE-2024-36912, CVE-2024-36913, CVE-2024-36916, CVE-2024-36917, CVE-2024-36918, CVE-2024-36927, CVE-2024-36929, CVE-2024-36933, CVE-2024-36938, CVE-2024-36971, CVE-2024-36974, CVE-2024-36978, CVE-2024-36979, CVE-2024-37356, CVE-2024-37370, CVE-2024-37371, CVE-2024-37568, CVE-2024-38538, CVE-2024-38555, CVE-2024-38556, CVE-2024-38557, CVE-2024-38564, CVE-2024-38576, CVE-2024-38577, CVE-2024-38580, CVE-2024-38586, CVE-2024-38588, CVE-2024-38596, CVE-2024-38598, CVE-2024-38601, CVE-2024-38612, CVE-2024-38615, CVE-2024-38627, CVE-2024-39276, CVE-2024-39298, CVE-2024-39329, CVE-2024-39330, CVE-2024-39371, CVE-2024-39474, CVE-2024-39476, CVE-2024-39482, CVE-2024-39487, CVE-2024-39489, CVE-2024-39490, CVE-2024-39494, CVE-2024-39499, CVE-2024-39500, CVE-2024-39501, CVE-2024-39508, CVE-2024-39509, CVE-2024-39614, CVE-2024-40900, CVE-2024-40905, CVE-2024-40906, CVE-2024-40908, CVE-2024-40914, CVE-2024-40919, CVE-2024-40931, CVE-2024-40935, CVE-2024-40937, CVE-2024-40938, CVE-2024-40945, CVE-2024-40947, CVE-2024-40953, CVE-2024-40954, CVE-2024-40957, CVE-2024-40958, CVE-2024-40959, CVE-2024-40960, CVE-2024-40961, CVE-2024-40966, CVE-2024-40972, CVE-2024-40980, CVE-2024-40982, CVE-2024-40984, CVE-2024-40990, CVE-2024-40995, CVE-2024-40997, CVE-2024-40998, CVE-2024-41000, CVE-2024-41001, CVE-2024-41005, CVE-2024-41007, CVE-2024-41009, CVE-2024-41012, CVE-2024-41020, CVE-2024-41027, CVE-2024-41031, CVE-2024-41040, CVE-2024-41041, CVE-2024-41042, CVE-2024-41048, CVE-2024-41049, CVE-2024-41050, CVE-2024-41057, CVE-2024-41058, CVE-2024-41073, CVE-2024-41077, CVE-2024-41079, CVE-2024-41081, CVE-2024-41090, CVE-2024-41091, CVE-2024-41096, CVE-2024-41098, CVE-2024-41989, CVE-2024-41991, CVE-2024-42005, CVE-2024-42063, CVE-2024-42067, CVE-2024-42068, CVE-2024-42080, CVE-2024-42098, CVE-2024-42106, CVE-2024-42131, CVE-2024-42135, CVE-2024-42136, CVE-2024-42145, CVE-2024-42152, CVE-2024-42154, CVE-2024-42159, CVE-2024-42229, CVE-2024-42232, CVE-2024-42239, CVE-2024-42241, CVE-2024-42243, CVE-2024-42245, CVE-2024-42247, CVE-2024-42265, CVE-2024-42268, CVE-2024-42269, CVE-2024-42270, CVE-2024-42276, CVE-2024-42281, CVE-2024-42283, CVE-2024-42285, CVE-2024-42292, CVE-2024-42302, CVE-2024-42304, CVE-2024-42305, CVE-2024-42306, CVE-2024-42312, CVE-2024-42315, CVE-2024-42316, CVE-2024-42318, CVE-2024-42321, CVE-2024-42322, CVE-2024-4317, CVE-2024-43817, CVE-2024-43828, CVE-2024-43834, CVE-2024-43837, CVE-2024-43853, CVE-2024-43854, CVE-2024-43856, CVE-2024-43866, CVE-2024-43869, CVE-2024-43870, CVE-2024-43871, CVE-2024-43873, CVE-2024-43882, CVE-2024-43889, CVE-2024-43890, CVE-2024-43892, CVE-2024-43893, CVE-2024-43914, CVE-2024-44934, CVE-2024-44940, CVE-2024-44944, CVE-2024-44946, CVE-2024-44947, CVE-2024-45490, CVE-2024-4603, CVE-2024-4741, CVE-202024-5535, CVE-2024-6119, CVE-2024-8008     November 2024   36.0

Pexip apps

Each bulletin addresses a number of vulnerabilities in the software used by the Pexip apps. The bulletins include an assessment of the issues, the impact on the Pexip app, and resolution details.

Bulletin Description Risk Updated Impacted versions Addressed in version
CVE-2024-38392

Insufficient authenticity checks in loading resources allow an attacker to cause the application to run untrusted code.

CVSS3.1 base score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.13.0 and Connect mobile app v1.13.0

Credit: This issue was responsibly disclosed by Mand Consulting Group

 Medium July 2024   1.13.0
CVE-2022-2478

Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023 Unknown 1.12
CVE-2022-2295

Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023

Unknown

 1.12
CVE-2022-2294

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023 Unknown 1.12
CVE-2022-2162

Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

High

 March 2023 Unknown 1.12
CVE-2022-2011

Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023 Unknown 1.12
 

Resolved minor issue: CVE-2022-1867

 

   March 2023   1.12

VMR self-service portal

Each bulletin addresses a number of vulnerabilities in the software used by the VMR self-service portal. The bulletins include an assessment of the issues, the impact on the VMR portal, and resolution details.

Bulletin Description Risk Updated Impacted versions Addressed in version
CVE-2023-40236

The Pexip VMR self-service portal before v3 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof fake instances by leveraging these keys.

CVSS 3.1 base score: 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: Manually remove and regenerate the SSH host keys on each VMR Portal instance.

Resolution: Upgrade to VMR portal v3.

 High October 2023 All prior to version 3 3

Enhanced Room Management

Each bulletin addresses a number of vulnerabilities in the software used by ERM. The bulletins include an assessment of the issues, the impact on the VMR portal, and resolution details.

Bulletin Description Risk Updated Impacted versions Addressed in version
CVE-2024-6387

A race condition was found in OpenSSH's server. If a client does not authenticate within 120 seconds then sshd's SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code with root privileges.

CVSS3.1 base score: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Mitigation: The mitigation for older versions (prior to v2.0.1) is to disable the Proxy service in the ERM Installer and redeploy, however we recommend upgrading to v2.0.1 as soon as practicable.

Resolution: Install v2.0.1 security upgrade 2024-07-09.

 High July 2024 All prior to version 2.0.1 2.0.1 security upgrade 2024-07-09

AIMS

Bulletin Description Risk Updated Impacted versions Addressed in version
 

Resolved minor issues: CVE-2011-10007, CVE-2022-49043, CVE-2023-0180, CVE-2023-0183, CVE-2023-0184, CVE-2023-0185, CVE-2023-0187, CVE-2023-0188, CVE-2023-0189, CVE-2023-0190, CVE-2023-0191, CVE-2023-0194, CVE-2023-0195, CVE-2023-0198, CVE-2023-0199, CVE-2023-4039, CVE-2023-4641, CVE-2023-25515, CVE-2023-25516, CVE-2023-28370, CVE-2023-29383, CVE-2023-31022, CVE-2023-31124, CVE-2023-31147, CVE-2023-31484, CVE-2023-39615, CVE-2023-40403, CVE-2023-45322, CVE-2023-48795, CVE-2023-49081, CVE-2023-49082, CVE-2023-51385, CVE-2023-51767, CVE-2023-52425, CVE-2023-52920, CVE-2024-0074, CVE-2024-0075, CVE-2024-0078, CVE-2024-0090, CVE-2024-0092, CVE-2024-0126, CVE-2024-0131, CVE-2024-0147, CVE-2024-0149, CVE-2024-0150, CVE-2024-5569, CVE-2024-7347, CVE-2024-8096, CVE-2024-8176, CVE-2024-8244, CVE-2024-12086, CVE-2024-12747, CVE-2024-13176, CVE-2024-25062, CVE-2024-25629, CVE-2024-26686, CVE-2024-27011, CVE-2024-27017, CVE-2024-27397, CVE-2024-28182, CVE-2024-34459, CVE-2024-36478, CVE-2024-43835, CVE-2024-45231, CVE-2024-45336, CVE-2024-45341, CVE-2024-46678, CVE-2024-46679, CVE-2024-46695, CVE-2024-46711, CVE-2024-46713, CVE-2024-46713, CVE-2024-46717, CVE-2024-46721, CVE-2024-46735, CVE-2024-46737, CVE-2024-46738, CVE-2024-46738, CVE-2024-46739, CVE-2024-46744, CVE-2024-46744, CVE-2024-46746, CVE-2024-46746, CVE-2024-46750, CVE-2024-46762, CVE-2024-46763, CVE-2024-46777, CVE-2024-46782, CVE-2024-46782, CVE-2024-46783, CVE-2024-46784, CVE-2024-46787, CVE-2024-46794, CVE-2024-46826, CVE-2024-46829, CVE-2024-46830, CVE-2024-46830, CVE-2024-46848, CVE-2024-46855, CVE-2024-46858, CVE-2024-46858, CVE-2024-47660, CVE-2024-47668, CVE-2024-47674, CVE-2024-47678, CVE-2024-47679, CVE-2024-47682, CVE-2024-47682, CVE-2024-47684, CVE-2024-47685, CVE-2024-47685, CVE-2024-47693, CVE-2024-47701, CVE-2024-47701, CVE-2024-47705, CVE-2024-47706, CVE-2024-47707, CVE-2024-47710, CVE-2024-47727, CVE-2024-47727, CVE-2024-47728, CVE-2024-47734, CVE-2024-47739, CVE-2024-47742, CVE-2024-47742, CVE-2024-47743, CVE-2024-47745, CVE-2024-47745, CVE-2024-47748, CVE-2024-47748, CVE-2024-49568, CVE-2024-49569, CVE-2024-49850, CVE-2024-49851, CVE-2024-49855, CVE-2024-49855, CVE-2024-49856, CVE-2024-49858, CVE-2024-49860, CVE-2024-49860, CVE-2024-49861, CVE-2024-49861, CVE-2024-49863, CVE-2024-49870, CVE-2024-49878, CVE-2024-49881, CVE-2024-49882, CVE-2024-49882, CVE-2024-49883, CVE-2024-49883, CVE-2024-49884, CVE-2024-49884, CVE-2024-49889, CVE-2024-49889, CVE-2024-49925, CVE-2024-49926, CVE-2024-49927, CVE-2024-49933, CVE-2024-49934, CVE-2024-49935, CVE-2024-49936, CVE-2024-49948, CVE-2024-49949, CVE-2024-49952, CVE-2024-49954, CVE-2024-49959, CVE-2024-49960, CVE-2024-49960, CVE-2024-49973, CVE-2024-49975, CVE-2024-49978, CVE-2024-49983, CVE-2024-49983, CVE-2024-49994, CVE-2024-50000, CVE-2024-50001, CVE-2024-50002, CVE-2024-50006, CVE-2024-50009, CVE-2024-50010, CVE-2024-50012, CVE-2024-50013, CVE-2024-50014, CVE-2024-50015, CVE-2024-50017, CVE-2024-50019, CVE-2024-50022, CVE-2024-50024, CVE-2024-50036, CVE-2024-50036, CVE-2024-50038, CVE-2024-50039, CVE-2024-50045, CVE-2024-50046, CVE-2024-50048, CVE-2024-50055, CVE-2024-50055, CVE-2024-50058, CVE-2024-50060, CVE-2024-50063, CVE-2024-50063, CVE-2024-50067, CVE-2024-50067, CVE-2024-50082, CVE-2024-50083, CVE-2024-50083, CVE-2024-50093, CVE-2024-50095, CVE-2024-50110, CVE-2024-50115, CVE-2024-50115, CVE-2024-50126, CVE-2024-50126, CVE-2024-50127, CVE-2024-50127, CVE-2024-50131, CVE-2024-50131, CVE-2024-50135, CVE-2024-50138, CVE-2024-50141, CVE-2024-50142, CVE-2024-50143, CVE-2024-50143, CVE-2024-50146, CVE-2024-50147, CVE-2024-50153, CVE-2024-50154, CVE-2024-50154, CVE-2024-50162, CVE-2024-50163, CVE-2024-50164, CVE-2024-50164, CVE-2024-50182, CVE-2024-50184, CVE-2024-50185, CVE-2024-50189, CVE-2024-50191, CVE-2024-50195, CVE-2024-50199, CVE-2024-50200, CVE-2024-50211, CVE-2024-50226, CVE-2024-50226, CVE-2024-50250, CVE-2024-50250, CVE-2024-50251, CVE-2024-50256, CVE-2024-50257, CVE-2024-50257, CVE-2024-50258, CVE-2024-50261, CVE-2024-50261, CVE-2024-50262, CVE-2024-50262, CVE-2024-50264, CVE-2024-50264, CVE-2024-50271, CVE-2024-50272, CVE-2024-50278, CVE-2024-50278, CVE-2024-50279, CVE-2024-50279, CVE-2024-50280, CVE-2024-50280, CVE-2024-50301, CVE-2024-50301, CVE-2024-50302, CVE-2024-50304, CVE-2024-50602, CVE-2024-53042, CVE-2024-53052, CVE-2024-53057, CVE-2024-53057, CVE-2024-53079, CVE-2024-53082, CVE-2024-53082, CVE-2024-53085, CVE-2024-53091, CVE-2024-53093, CVE-2024-53099, CVE-2024-53099, CVE-2024-53105, CVE-2024-53124, CVE-2024-53125, CVE-2024-53128, CVE-2024-53141, CVE-2024-53141, CVE-2024-53142, CVE-2024-53142, CVE-2024-53164, CVE-2024-53166, CVE-2024-53166, CVE-2024-53170, CVE-2024-53170, CVE-2024-53175, CVE-2024-53194, CVE-2024-53194, CVE-2024-53198, CVE-2024-53209, CVE-2024-53214, CVE-2024-53214, CVE-2024-53222, CVE-2024-53224, CVE-2024-53233, CVE-2024-53240, CVE-2024-53241, CVE-2024-53869, CVE-2024-54683, CVE-2024-55549, CVE-2024-56171, CVE-2024-56406, CVE-2024-56549, CVE-2024-56566, CVE-2024-56569, CVE-2024-56570, CVE-2024-56570, CVE-2024-56583, CVE-2024-56584, CVE-2024-56587, CVE-2024-56592, CVE-2024-56600, CVE-2024-56600, CVE-2024-56601, CVE-2024-56601, CVE-2024-56606, CVE-2024-56606, CVE-2024-56611, CVE-2024-56614, CVE-2024-56614, CVE-2024-56615, CVE-2024-56615, CVE-2024-56631, CVE-2024-56631, CVE-2024-56633, CVE-2024-56633, CVE-2024-56636, CVE-2024-56637, CVE-2024-56640, CVE-2024-56640, CVE-2024-56641, CVE-2024-56644, CVE-2024-56658, CVE-2024-56658, CVE-2024-56662, CVE-2024-56664, CVE-2024-56664, CVE-2024-56672, CVE-2024-56672, CVE-2024-56675, CVE-2024-56675, CVE-2024-56693, CVE-2024-56693, CVE-2024-56703, CVE-2024-56709, CVE-2024-56718, CVE-2024-56720, CVE-2024-56739, CVE-2024-56745, CVE-2024-56751, CVE-2024-56756, CVE-2024-56763, CVE-2024-56770, CVE-2024-56780, CVE-2024-56786, CVE-2024-56786, CVE-2024-57843, CVE-2024-57882, CVE-2024-57883, CVE-2024-57884, CVE-2024-57888, CVE-2024-57890, CVE-2024-57900, CVE-2024-57900, CVE-2024-57903, CVE-2024-57917, CVE-2024-57917, CVE-2024-57924, CVE-2024-57929, CVE-2024-57929, CVE-2024-57931, CVE-2024-57940, CVE-2024-57977, CVE-2024-58005, CVE-2024-58017, CVE-2024-58078, CVE-2024-58083, CVE-2024-58085, CVE-2024-58088, CVE-2024-58090, CVE-2024-58098, CVE-2024-58100, CVE-2024-58237, CVE-2025-0938, CVE-2025-1390, CVE-2025-4207, CVE-2025-4598, CVE-2025-4673, CVE-2025-4802, CVE-2025-6021, CVE-2025-6170, CVE-2025-6199, CVE-2025-6965, CVE-2025-7424, CVE-2025-7425, CVE-2025-8058, CVE-2025-8713, CVE-2025-9230, CVE-2025-9232, CVE-2025-21648, CVE-2025-21653, CVE-2025-21664, CVE-2025-21665, CVE-2025-21666, CVE-2025-21667, CVE-2025-21669, CVE-2025-21680, CVE-2025-21681, CVE-2025-21683, CVE-2025-21700, CVE-2025-21701, CVE-2025-21702, CVE-2025-21706, CVE-2025-21712, CVE-2025-21738, CVE-2025-21745, CVE-2025-21756, CVE-2025-21758, CVE-2025-21759, CVE-2025-21760, CVE-2025-21761, CVE-2025-21762, CVE-2025-21763, CVE-2025-21764, CVE-2025-21765, CVE-2025-21766, CVE-2025-21767, CVE-2025-21779, CVE-2025-21790, CVE-2025-21791, CVE-2025-21814, CVE-2025-21831, CVE-2025-21836, CVE-2025-21839, CVE-2025-21846, CVE-2025-21853, CVE-2025-21854, CVE-2025-21857, CVE-2025-21858, CVE-2025-21862, CVE-2025-21863, CVE-2025-21864, CVE-2025-21867, CVE-2025-21872, CVE-2025-21875, CVE-2025-21881, CVE-2025-21887, CVE-2025-21889, CVE-2025-21891, CVE-2025-21895, CVE-2025-21898, CVE-2025-21899, CVE-2025-21908, CVE-2025-21913, CVE-2025-21919, CVE-2025-21920, CVE-2025-21926, CVE-2025-21931, CVE-2025-21938, CVE-2025-21951, CVE-2025-21959, CVE-2025-21960, CVE-2025-21966, CVE-2025-21971, CVE-2025-21980, CVE-2025-21991, CVE-2025-21992, CVE-2025-21993, CVE-2025-21997, CVE-2025-21999, CVE-2025-22005, CVE-2025-22021, CVE-2025-22035, CVE-2025-22044, CVE-2025-22045, CVE-2025-22055, CVE-2025-22056, CVE-2025-22057, CVE-2025-22058, CVE-2025-22063, CVE-2025-22064, CVE-2025-22075, CVE-2025-22083, CVE-2025-22086, CVE-2025-22089, CVE-2025-22090, CVE-2025-22126, CVE-2025-22247, CVE-2025-22866, CVE-2025-22870, CVE-2025-22871, CVE-2025-23136, CVE-2025-23141, CVE-2025-23142, CVE-2025-23145, CVE-2025-23150, CVE-2025-23163, CVE-2025-23244, CVE-2025-24855, CVE-2025-24928, CVE-2025-27113, CVE-2025-31115, CVE-2025-32414, CVE-2025-32415, CVE-2025-32462, CVE-2025-32728, CVE-2025-32873, CVE-2025-37738, CVE-2025-37756, CVE-2025-37772, CVE-2025-37773, CVE-2025-37780, CVE-2025-37785, CVE-2025-37789, CVE-2025-37797, CVE-2025-37798, CVE-2025-37800, CVE-2025-37808, CVE-2025-37820, CVE-2025-37823, CVE-2025-37836, CVE-2025-37839, CVE-2025-37857, CVE-2025-37859, CVE-2025-37867, CVE-2025-37878, CVE-2025-37884, CVE-2025-37885, CVE-2025-37890, CVE-2025-37911, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915, CVE-2025-37921, CVE-2025-37923, CVE-2025-37928, CVE-2025-37932, CVE-2025-37936, CVE-2025-37938, CVE-2025-37940, CVE-2025-37949, CVE-2025-37957, CVE-2025-37958, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37980, CVE-2025-37988, CVE-2025-37992, CVE-2025-37997, CVE-2025-37998, CVE-2025-38000, CVE-2025-38008, CVE-2025-38018, CVE-2025-38020, CVE-2025-38035, CVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38048, CVE-2025-38058, CVE-2025-38061, CVE-2025-38062, CVE-2025-38063, CVE-2025-38066, CVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074, CVE-2025-38075, CVE-2025-38078, CVE-2025-38079, CVE-2025-38083, CVE-2025-38084, CVE-2025-38085, CVE-2025-38087, CVE-2025-38095, CVE-2025-38097, CVE-2025-38100, CVE-2025-38102, CVE-2025-38103, CVE-2025-38107, CVE-2025-38108, CVE-2025-38110, CVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115, CVE-2025-38122, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148, CVE-2025-38149, CVE-2025-38161, CVE-2025-38165, CVE-2025-38166, CVE-2025-38177, CVE-2025-38181, CVE-2025-38182, CVE-2025-38192, CVE-2025-38193, CVE-2025-38198, CVE-2025-38202, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214, CVE-2025-38215, CVE-2025-38220, CVE-2025-38222, CVE-2025-38236, CVE-2025-38246, CVE-2025-38255, CVE-2025-38263, CVE-2025-38280, CVE-2025-38282, CVE-2025-38285, CVE-2025-38305, CVE-2025-38310, CVE-2025-38312, CVE-2025-38324, CVE-2025-38326, CVE-2025-38334, CVE-2025-38337, CVE-2025-38342, CVE-2025-38344, CVE-2025-38345, CVE-2025-38346, CVE-2025-38349, CVE-2025-38352, CVE-2025-38364, CVE-2025-38375, CVE-2025-38386, CVE-2025-38387, CVE-2025-38396, CVE-2025-38399, CVE-2025-38403, CVE-2025-38415, CVE-2025-38424, CVE-2025-38439, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38455, CVE-2025-38457, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38465, CVE-2025-38466, CVE-2025-38468, CVE-2025-38470, CVE-2025-38471, CVE-2025-38477, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38498, CVE-2025-38637, CVE-2025-39989, CVE-2025-40364, CVE-2025-40909, CVE-2025-46712, CVE-2025-46836, CVE-2025-47906, CVE-2025-48432, CVE-2025-49794, CVE-2025-49796, CVE-2025-53859

   October 2025   2.0