BigBlueButton 跨站脚本漏洞

BigBlueButton is a Web conferencing system. versions prior to BigBlueButton 2.4.8 and prior to 2.5.0 have a cross-site scripting vulnerability that stems from the fact that users in private chat-enabled conferences are vulnerable to cross-site scripting attacks. An attacker could exploit the...

BigBlueButton 安全漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. BigBlueButton Greenlight has a security vulnerability that could be exploited by an attacker to view the settings of any room...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

Cross site scripting

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton up to version 2.4.7 is vulnerable to stored XSS in the private chat feature. An attacker can inject a JavaScript payload in their username, which is executed in the victim’s browser on private messages or when leaving the room notifications are shown. The core issue is insufficient ...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-27238: Improper Neutralization of Input During Web Page Generation

BigBlueButton version 2.4.7 or earlier is vulnerable to stored Cross-Site Scripting XSS in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to t...

CVE-2022-31788

IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname...

BigBlueButton Cross-Site Scripting Vulnerability (CNVD-2022-82635)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton Greenlight has a cross-site scripting vulnerability that stems from a username containing a JavaScript payload. No detailed vulnerability details are available at this time...

BigBlueButton Licensing Issue Vulnerability (CNVD-2022-82636)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. bigBlueButton has an authorization issue vulnerability that can be exploited by attackers to send messages to locked chats within a 5s grace period after lockdown settings take effect...

BigBlueButton Information Disclosure Vulnerability (CNVD-2022-82638)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an information disclosure vulnerability that stems from the lack of information protection measures and access controls for service meeting announcement chat messages.An attacker...

BigBlueButton licensing issue vulnerability

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. bigBlueButton has an authorization issue vulnerability that stems from the application's lack of required permission checks, which could be exploited by an attacker to bypass access restrictions in order to...

BigBlueButton Information Disclosure Vulnerability (CNVD-2022-82640)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to find information related to an external video being shared...

BigBlueButton Licensing Issue Vulnerability (CNVD-2022-82637)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an authorization issue vulnerability that can be exploited by attackers to bypass access controls to access all breakout rooms of the conference they are in...

CVE-2022-26497

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously...

CVE-2022-26497

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously...

Design/Logic Flaw

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously...