CVE-2023-42803 BigBlueButton Unrestricted File Upload vulnerability

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures...

BigBlueButton Code Issue Vulnerability

BigBlueButton is an open source web conferencing system from the BigBlueButton community. BigBlueButton has a code issue vulnerability that stems from vulnerability to server-side request forgery SSRF attacks...

BigBlueButton Cross-Site Scripting Vulnerability

BigBlueButton is an open source web conferencing system from the BigBlueButton community. A cross-site scripting vulnerability exists in BigBlueButton versions prior to 2.6.11, and prior to 2.7.0-beta.3, which stems from a cross-site scripting XSS vulnerability in Guest Lobby...

BigBlueButton Path Traversal Vulnerability

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. A path traversal vulnerability exists in BigBlueButton versions prior to 2.6.0, which stems from the presence of a path traversal vulnerability. An unauthenticated attacker can exploit this vulnerability to...

CVE-2023-42804: Improper Limitation of a Pathname to a Restricted Directory

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions txt, swf...

CVE-2023-43797: Improper Neutralization of Input During Web Page Generation

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...

PT-2023-28990 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.12 BigBlueButton versions prior to 2.7.0-rc.1 Description: The issue is related to Server-Side Request Forgery SSRF, which is a bypass of a previously known problem. A patch was applied to disable follow...

PT-2023-28589 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.0-beta.2 Description: BigBlueButton is an open-source virtual classroom. The issue arises from the insertDocument API call not validating the given file extension before saving the file and not removing it ...

CVE-2023-42803: Unrestricted Upload of File with Dangerous Type

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures...

BigBlueButton Code Issue Vulnerability

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. A code issue vulnerability exists in BigBlueButton versions prior to 2.6.0 that stems from a file upload vulnerability in the insertDocument API...

CVE-2023-43798: Server-Side Request Forgery (SSRF)

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery SSRF. This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at httpclient.execute since the...

BigBlueButton <= 3.0.0-beta.4 - Reflected XSS

Description The plugin does not sanitise and escape the username and tempentrypass parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-39991

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blindside Networks BigBlueButton plugin = 3.0.0-beta.4 versions...

CVE-2023-39991

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blindside Networks BigBlueButton plugin = 3.0.0-beta.4 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blindside Networks BigBlueButton plugin = 3.0.0-beta.4 versions...

CVE-2023-39991 WordPress BigBlueButton Plugin <= 3.0.0-beta.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blindside Networks BigBlueButton plugin = 3.0.0-beta.4 versions...

CVE-2023-39991

CVE-2023-39991 : Affects WordPress plugin Blindside Networks BigBlueButton, version

CVE-2023-39991 WordPress BigBlueButton Plugin <= 3.0.0-beta.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blindside Networks BigBlueButton plugin = 3.0.0-beta.4 versions...

WordPress plugin bigbluebutton cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2023-39991: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blindside Networks BigBlueButton plugin = 3.0.0-beta.4 versions...