Vyacheslav Kopeytsev

**Name of the Vulnerable Software and Affected Versions** TrueConf Server versions 5.3.x through 5.3.9 TrueConf Server versions 5.4.x through 5.4.9 TrueConf Server versions 5.5.x through 5.5.5 TrueConf Server versions prior to 5.5.5 **Description** An issue exists where a remote unauthorized attacker with network access via port 4307/TCP can execute an arbitrary script and escalate privileges by calling an undocumented critical function. This is caused by a lack of authentication for that specific function. Real-world exploitation of this issue has been recorded. **Recommendations** Update TrueConf Server versions 5.3.x through 5.3.9 to a version newer than 5.3.9. Update TrueConf Server versions 5.4.x through 5.4.9 to a version newer than 5.4.9. Update TrueConf Server versions 5.5.x through 5.5.5 to a version newer than 5.5.5. Update TrueConf Server versions prior to 5.5.5 to a version newer than 5.5.5.

**Name of the Vulnerable Software and Affected Versions** TrueConf server versions 5.3.0 through 5.3.9 TrueConf server versions 5.4.0 through 5.4.9 TrueConf server versions 5.5.0 through 5.5.5 TrueConf server versions prior to 5.3.0 **Description** Improper management of code generation allows a remote unauthorized attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment (sandbox) and execute arbitrary code on the host operating system. Real-world exploitation of this issue has been recorded. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.