CVE-2021-45900

Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf.

• CWE-287

• https://vivoh.com/blog/finra-remediation/Exploit, Vendor Advisory
• https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdfBroken Link
• https://vivoh.com/blog/finra-remediation/Exploit, Vendor Advisory
• https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdfBroken Link

Published

Mar 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-45894An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4.…5.9
• CVE-2021-45895Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.…6.1
• CVE-2021-45896Nokia FastMile 3TG00118ABAD52 devices allow privilege escala…8.8
• CVE-2021-45897SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote co…8.8
• CVE-2021-45898SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local fil…9.8
• CVE-2021-45899SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR dese…9.8
• CVE-2021-45901The password-reset form in ServiceNow Orlando provides diffe…5.3
• CVE-2021-45903A persistent cross-site scripting (XSS) issue in the web int…6.1
• CVE-2021-45904OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name sc…5.4
• CVE-2021-45905OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen…5.4
• CVE-2021-45906OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.5.4
• CVE-2021-45907An issue was discovered in gif2apng 1.9. There is a stack-ba…7.8