CVE-2020-12113

BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...

CVE-2020-12112

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

CVE-2020-12113

BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...

CVE-2020-12112

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

Cross site scripting

BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...

Design/Logic Flaw

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

CVE-2020-12112

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...

CVE-2020-12112

BigBlueButton had an LFI/vulnerability in versions before 2.2.5 (CVE-2020-12112). Connected sources also describe a related issue (CVE-2020-12443) where case-insensitive handling of presFilename/presfilename enables directory traversal to bigbluebutton.properties, enabling reading of arbitrary fi...

CVE-2020-12113

BigBlueButton is affected by CVE-2020-12113: prior to version 2.2.4, the Web UI is vulnerable to cross-site scripting via closed captions because dangerouslySetInnerHTML is used in React. This vulnerability allows XSS as described in multiple sources (e.g., BigBlueButton’s 2.2.4 release notes and...

CVE-2020-12113

BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...

PT-2020-13043 · Bigbluebutton · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.5 Description: The issue allows remote attackers to obtain sensitive files via Local File Inclusion. Recommendations: For versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue...

BigBlueButton < 2.2.4 - Reflected Cross-Site Scripting (XSS)

XSS via closed captions because dangerouslySetInnerHTML in React is used...