CVE-2021-34823

The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticated remote users to retrieve files accessible to the logged-on macOS user. When a remote user sends a crafted HTTP request to the server, it triggers a code path that will download a configuration file from a specified remote machine over HTTP. There is an XXE flaw in processing of this configuration file that allows reading local (to macOS) files and uploading them to remote machines.

• CWE-611

• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/Third Party Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105Third Party Advisory

Published

Aug 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34815CheckSec Canopy before 3.5.2 allows XSS attacks against the …4.8
• CVE-2021-34816An Argument Injection issue in the plugin management of Ethe…7.2
• CVE-2021-34817A Cross-Site Scripting (XSS) issue in the chat component of …6.1
• CVE-2021-3482A flaw was found in Exiv2 in versions before and including 0…6.5
• CVE-2021-34820Web Path Directory Traversal in the Novus HTTP Server. The N…7.5
• CVE-2021-34821Cross Site Scripting (XSS) vulnerability exists in AAT Novus…6.1
• CVE-2021-34824Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remo…8.8
• CVE-2021-34825Quassel through 0.13.1, when --require-ssl is enabled, launc…7.5
• CVE-2021-34827This vulnerability allows network-adjacent attackers to exec…8.8
• CVE-2021-34828This vulnerability allows network-adjacent attackers to exec…8.8
• CVE-2021-34829This vulnerability allows network-adjacent attackers to exec…8.8
• CVE-2021-3483A flaw was found in the Nosy driver in the Linux kernel. Thi…7.8