CVE-2016-0784

Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.

• CWE-22

• http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code
• http://openmeetings.apache.org/security.htmlPatch, Vendor Advisory
• http://packetstormsecurity.com/files/136484/Apache-OpenMeetings-3.1.0-Path-Traversal.html
• http://www.openwall.com/lists/oss-security/2016/03/25/2
• http://www.securityfocus.com/archive/1/537929/100/0/threaded
• https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOGVendor Advisory
• https://www.exploit-db.com/exploits/39642/
• http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code
• http://openmeetings.apache.org/security.htmlPatch, Vendor Advisory
• http://packetstormsecurity.com/files/136484/Apache-OpenMeetings-3.1.0-Path-Traversal.html
• http://www.openwall.com/lists/oss-security/2016/03/25/2
• http://www.securityfocus.com/archive/1/537929/100/0/threaded
• https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOGVendor Advisory
• https://www.exploit-db.com/exploits/39642/

Published

Apr 11, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-0778The (1) roaming_read and (2) roaming_write functions in roam…8.1
• CVE-2016-0779The EjbObjectInputStream class in Apache TomEE before 1.7.4 …
• CVE-2016-0780It was discovered that cf-release v231 and lower, Pivotal Cl…7.5
• CVE-2016-0781The UAA OAuth approval pages in Cloud Foundry v208 to v231, …
• CVE-2016-0782The administration web console in Apache ActiveMQ 5.x before…
• CVE-2016-0783The sendHashByUser function in Apache OpenMeetings before 3.…
• CVE-2016-0785Apache Struts 2.x before 2.3.28 allows remote attackers to e…
• CVE-2016-0786Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0787The diffie_hellman_sha256 function in kex.c in libssh2 befor…
• CVE-2016-0788The remoting module in Jenkins before 1.650 and LTS before 1…
• CVE-2016-0789CRLF injection vulnerability in the CLI command documentatio…
• CVE-2016-0790Jenkins before 1.650 and LTS before 1.642.2 do not use a con…