622 matches found
Code injection
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint...
Design/Logic Flaw
BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant...
Code injection
In BigBlueButton before 2.2.28 or earlier, the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or...
Default credentials
The installation procedure in BigBlueButton before 2.2.28 or earlier uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access...
Improper access control
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
Design/Logic Flaw
Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to outsiders if any user publishes a screenshot of a browser window...
CVE-2020-27601
BigBlueButton before 2.2.7: the setting lockSettingsProps.disablePrivateChat is not applied to chats that are already open. Root cause is in bigbluebutton-html5/imports/ui/components/chat/service.js. Impact is that private-chat restrictions may not be enforced for existing chats (low severity per...
CVE-2020-27601
In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js...
CVE-2020-27603
BigBlueButton prior to 2.2.27 is affected by an unsafe JODConverter setting that allows LibreOffice document conversions to access external files. The root cause is the JODConverter configuration used during server-side rendering, enabling potential data exfiltration via LibreOffice processing. T...
CVE-2020-27603
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
CVE-2020-27604
BigBlueButton before 2.3 does not implement LibreOffice sandboxing, enabling remote authenticated users to read the API shared secret in bigbluebutton.properties and potentially join arbitrary meetings via api/join regardless of guestPolicy. Affected software: BigBlueButton prior to 2.3. Root cau...
CVE-2020-27604
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can for example use api/join to join an arbitrary meeting...
CVE-2020-27605
Technical details about CVE-2020-27605 are not publicly available in the provided connected documents. Monitor for updates from official sources to assess affected components, impact, and remediation.
CVE-2020-27605
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."...
CVE-2020-27607
In BigBlueButton before 2.2.28 or earlier, the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or...
CVE-2020-27607
CVE-2020-27607 affects BigBlueButton before 2.2.28. The client-side Mute button does not directly stop sending audio; it only signals the server to stop accepting audio data. A modified server could store audio data and/or transmit it to participants or third parties. Affected component: client-s...
CVE-2020-27609
BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant...
CVE-2020-27609
CVE-2020-27609 affects BigBlueButton up to version 2.2.28, where video meetings are recorded despite the user interface indicating that video recording is deactivated. The result is potential data storage beyond what is authorized for a given meeting topic or participant. The connected Red Hat an...
CVE-2020-27611
CVE-2020-27611 affects BigBlueButton up to version 2.2.28 . The issue, described across sources, is that BigBlueButton uses STUN/TURN resources from a third party, which may represent an unintended endpoint. The publicly provided documents do not specify a concrete root cause in code, a CVE-preci...