Cross site scripting

Cross-site Scripting XSS - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0...

CVE-2021-4143 Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton

Cross-site Scripting XSS - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0...

CVE-2021-4143

CVE-2021-4143 affects the open‑source web conferencing platform BigBlueButton prior to 2.4.0. The vulnerability is a generic Cross-site Scripting (XSS) due to lack of proper validation of client‑side data by the web application, enabling injection of arbitrary JavaScript in other users’ browsers ...

BigBlueButton 跨站脚本漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton Bigbluebutton community. bigbluebutton suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerabilit...

Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton

Description Shared notes panel is vulnerable to XSS when rendering a new note, due to missing username sanitization. Proof of Concept 1. 1.Start a new web conference and share the link with other people 2. 2.A malicious user joins the conference with the following username: 3. 3.As soon as the...

BigBlueButton Conference Access Code Brute Force Attack Vulnerability

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A conference access code brute force attack vulnerability exists in BigBlueButton 2.2.29 and earlier versions. The vulnerability stems from the ability to enter an unlimited amount of code for a conference...

BigBlueButton Email Authentication Bypass Vulnerability

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . An email authentication bypass vulnerability exists in BigBlueButton 2.2.29 and earlier versions. An attacker who can view accountactivations/edit?token= URI can exploit this vulnerability to create approve...

CVE-2020-29043

An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an accountactivations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name...

CVE-2020-29042

An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code...

CVE-2020-29042

An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code...

CVE-2020-29043

An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an accountactivations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name...

Code injection

An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code...

Code injection

An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an accountactivations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name...

CVE-2020-29042

An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code...

CVE-2020-29042

CVE-2020-29042 : The issue affects BigBlueButton up to version 2.2.29, where an unlimited number of access codes can be entered for a meeting, enabling brute-force attempts to bypass access protection. The impact is potential unauthorized meeting access; the description does not specify whether e...

CVE-2020-29043

BigBlueButton 2.2.29 (and earlier) contains an email-activation bypass: an attacker who can view the account_activations/edit?token= URI can create approved user accounts tied to arbitrary domain emails. The root cause is exposure of the verification token in the GET request, enabling unauthorize...

CVE-2020-29043

An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an accountactivations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name...

BigBlueButton 2.2.29 E-mail Validation Bypass

Title: BigBlueButton E-mail Validation Bypass Google Dork: N/A Date: 24.11.2020 Author: Seccops https://seccops.com Vendor Homepage: bigbluebutton.org Version: 2.2.29 and previous versions CVE: CVE-2020-29043 === Summary === An issue was discovered in BigBlueButton through 2.2.29. When at attacke...

BigBlueButton 安全漏洞

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A conference access code brute force attack vulnerability exists in BigBlueButton 2.2.29 and earlier versions. The vulnerability stems from the ability to enter an unlimited amount of code for a conference...

BigBlueButton 安全漏洞

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . An email authentication bypass vulnerability exists in BigBlueButton 2.2.29 and earlier versions. An attacker who can view accountactivations/edit?token= URI can exploit this vulnerability to create approve...