CVE-2020-27602

BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken...

CVE-2020-25820

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...

CVE-2020-25820

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...

Server side request forgery (ssrf)

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...

CVE-2020-25820

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...

CVE-2020-25820

CVE-2020-25820 — BigBlueButton before 2.2.7 allows remote authenticated users to read local files and perform server-side requests via an uploaded Office document containing a crafted URL in an ODF xlink field, enabling Arbitrary File Disclosure and SSRF. Affected product: BigBlueButton web confe...

PT-2020-16711 · Bigbluebutton · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.7 Description: The issue arises from the lockSettingsProps.disablePrivateChat setting not being applied to chats that are already open. This problem is located in the...

BigBlueButton 2.2.25 File Disclosure / Server-Side Request Forgery

Advisory: Arbitrary File Disclosure and Server-Side Request Forgery in BigBlueButton RedTeam Pentesting discovered a vulnerability in the BigBlueButton web conferencing system which allows participants of a conference with permissions to upload presentations to read arbitrary files from the file...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

Design/Logic Flaw

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 is affected by an HTTP header (Host and Origin) input issue that enables account takeover when a user clicks a spoofed password‑reset link. Root cause: header handling allows spoofing of origins/hosts. Impact: potential account compromise; attacks require net...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

Directory traversal

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

CVE-2020-12443

CVE-2020-12443 affects BigBlueButton before 2.2.6, allowing remote read of files via directory traversal: presfilename (lowercase) can be a .pdf while presFilename (mixed case) contains ../, enabling traversal to bigbluebutton.properties. The issue ties to an ineffective mitigation for CVE-2020-1...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

BigBlueButton Information Disclosure Vulnerability

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A security vulnerability exists in BigBlueButton versions prior to 2.2.5. A remote attacker can exploit the vulnerability to obtain sensitive information...

BigBlueButton Cross-Site Scripting Vulnerability

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton versions prior to 2.2.4. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...