CVE-2022-41963

BigBlueButton contains an issue in the whiteboard grace period used to handle delayed messages. Versions prior to 2.4.3 allow a meeting participant with revoked access to take actions within a few seconds after revocation due to this grace period. The vulnerability is mitigated in version 2.4.3 a...

CVE-2022-41963 BigBlueButton contains Improper Preservation of Permissions for whiteboard

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a...

CVE-2022-41963 BigBlueButton contains Improper Preservation of Permissions for whiteboard

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a...

CVE-2022-41962

BigBlueButton contains a vulnerability (CVE-2022-41962) described as Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users, whereas moderators should only be able to set none. Affected versions are p...

CVE-2022-41962 BigBlueButton contains Incorrect Authorization for setting emoji status

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to s...

CVE-2022-41961

CVE-2022-41961 affects BigBlueButton. Versions prior to 2.4-rc-6 are vulnerable to ineffective user bans: banning a user does not remove all accounts tied to the same extId, allowing an attacker who registers multiple users to rejoin a meeting. Root cause is insufficient permission/data purge whe...

CVE-2022-41961 BigBlueButton subject to Ineffective user bans

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered...

CVE-2022-41961 BigBlueButton subject to Ineffective user bans

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered...

Design/Logic Flaw

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...

PT-2022-26186 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.4-rc-6 BigBlueButton versions prior to 2.5-alpha-1 Description: BigBlueButton is an open source web conferencing system. The issue concerns Incorrect Authorization for setting emoji status. A user with...

CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...

CVE-2022-41960

CVE-2022-41960 (BigBlueButton) affects BigBlueButton versions prior to 2.4.3. The issue is due to Insufficient Verification of Data Authenticity that allows a participant to trigger a Denial of Service by calling validateAuthToken with a victim’s userId, meetingId, and an invalid authToken. The v...

CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...

The vulnerability of the Zoom video conferencing service relates to an uncontrolled element in the search process, allowing a malicious actor to elevate their privileges to that of the SYSTEM user.

The vulnerability of the Zoom video conferencing service is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to that of the SYSTEM user...

CVE-2022-41971

Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public...

Code injection

Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public...

CVE-2022-41971

Nextcloud Talk for Android suffers a vulnerability where guests removed from a conversation can continue to receive video streams in a public call. Affected versions prior to 12.2.8, 13.0.10, 14.0.6, and 15.0.0 are vulnerable; patches are provided in those respective versions. The issue enables a...

CVE-2022-41326

The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application...

Authorization

The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application...

PT-2022-25816 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.6.0.13 Description: The web conferencing component could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code...