622 matches found
CVE-2020-27613
The installation procedure in BigBlueButton before 2.2.28 or earlier uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access...
CVE-2020-27613
Summary: CVE-2020-27613 affects BigBlueButton before 2.2.28 where the installation procedure uses ClueCon as the FreeSWITCH password, enabling local users to gain unintended FreeSWITCH access. Affected software: BigBlueButton (versions before 2.2.28). Vulnerability details: Local authentication w...
CVE-2020-27612
CVE-2020-27612 affects BigBlueButton Greenlight up to version 2.2.28. The issue: usernames are included in room URLs, potentially leaking user identity to room participants or outsiders if a screenshot is shared. The connected documents confirm the impact as an information leak but do not provide...
CVE-2020-27610
The installation procedure in BigBlueButton before 2.2.28 or earlier exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access...
CVE-2020-27610
BigBlueButton CVE-2020-27610 affects the BigBlueButton installation procedure prior to 2.2.28. The issue arises because the installer exposes certain network services to external interfaces and does not automatically configure a firewall to block external access. The prompt does not provide explo...
CVE-2020-27608
In BigBlueButton before 2.2.28 or earlier, uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document...
CVE-2020-27608
BigBlueButton vulnerability CVE-2020-27608 affects versions prior to 2.2.28. The issue stems from uploaded presentations being sent to clients without a Content-Type header, enabling cross-site scripting (XSS) evidenced by a .png file extension used for an HTML document. Impact is limited to XSS ...
CVE-2020-27606
BigBlueButton is affected pre-2.2.28: the session cookie is not marked Secure in HTTPS, enabling cookie capture if an attacker can observe HTTP traffic. Affected product: BigBlueButton; vulnerable component: session cookie handling; root cause: absence of Secure flag on the cookie in HTTPS sessio...
CVE-2020-27606
BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...
CVE-2020-27602
CVE-2020-27602 (BigBlueButton) affects BigBlueButton versions prior to 2.2.7. The root cause is a lack of protection against separator injection in three parameters: meetingId, userId, and authToken. This vulnerability could enable unintended manipulation of identifiers and tokens due to insuffic...
CVE-2020-27602
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken...
CVE-2020-25820
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...
CVE-2020-25820
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...
Server side request forgery (ssrf)
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...
CVE-2020-25820
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...
CVE-2020-25820
CVE-2020-25820 — BigBlueButton before 2.2.7 allows remote authenticated users to read local files and perform server-side requests via an uploaded Office document containing a crafted URL in an ODF xlink field, enabling Arbitrary File Disclosure and SSRF. Affected product: BigBlueButton web confe...
BigBlueButton 2.2.25 File Disclosure / Server-Side Request Forgery
Advisory: Arbitrary File Disclosure and Server-Side Request Forgery in BigBlueButton RedTeam Pentesting discovered a vulnerability in the BigBlueButton web conferencing system which allows participants of a conference with permissions to upload presentations to read arbitrary files from the file...
PT-2020-16711 · Bigbluebutton · Bigbluebutton
Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.7 Description: The issue arises from the lockSettingsProps.disablePrivateChat setting not being applied to chats that are already open. This problem is located in the...