Cross site scripting

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker with xss in the name starts a chat. in the victim's client the JavaScript will be executed...

Design/Logic Flaw

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker whose username contains malicious JavaScript, the script gets...

CVE-2022-31064 Cross site scripting in username that will trigger by sending chat

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker with xss in the name starts a chat. in the victim's client the JavaScript will be executed...

CVE-2022-31064

BigBlueButton’s CVE-2022-31064 is a cross-site scripting (XSS) vulnerability in meetings with private chat enabled. Affected versions before 2.4.8 and before 2.5.0 allow an attacker to inject JavaScript when starting a private chat, which executes in the victim’s browser. Remediation per sources ...

CVE-2022-31064 Cross site scripting in username that will trigger by sending chat

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker with xss in the name starts a chat. in the victim's client the JavaScript will be executed...

CVE-2022-31064 Cross site scripting in username that will trigger by sending chat

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker with xss in the name starts a chat. in the victim's client the JavaScript will be executed...

CVE-2022-31065

CVE-2022-31065 affects BigBlueButton prior to versions 2.4.8 and 2.5.0. The vulnerability allows an attacker to embed malicious JavaScript in their username, which is executed on the victim’s client when the attacker sends a private chat or when a notification of the attacker leaving the session ...

CVE-2022-31065 Cross site scripting vulnerability for private chat in bigbluebutton

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker whose username contains malicious JavaScript, the script gets...

CVE-2022-31065 Cross site scripting vulnerability for private chat in bigbluebutton

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker whose username contains malicious JavaScript, the script gets...

CVE-2022-31065 Cross site scripting vulnerability for private chat in bigbluebutton

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker whose username contains malicious JavaScript, the script gets...

CVE-2022-31039

Greenlight (BigBlueButton frontend) is affected by CVE-2022-31039. In affected versions, an attacker can view any room’s settings without authorization, contrary to intended access control for room owners/administrators. The issue has been patched in release version 2.12.6. The CVSS details from ...

BigBlueButton 跨站脚本漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.A cross-site scripting vulnerability exists in versions prior to BigBlueButton 2.4.8 and prior to 2.5.0, which stems from users in private chat-enabled meetings being vulnerable to malicious JavaScript attack...

BigBlueButton 跨站脚本漏洞

BigBlueButton is a Web conferencing system. versions prior to BigBlueButton 2.4.8 and prior to 2.5.0 have a cross-site scripting vulnerability that stems from the fact that users in private chat-enabled conferences are vulnerable to cross-site scripting attacks. An attacker could exploit the...

BigBlueButton 安全漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. BigBlueButton Greenlight has a security vulnerability that could be exploited by an attacker to view the settings of any room...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

Cross site scripting

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton up to version 2.4.7 is vulnerable to stored XSS in the private chat feature. An attacker can inject a JavaScript payload in their username, which is executed in the victim’s browser on private messages or when leaving the room notifications are shown. The core issue is insufficient ...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...