711 matches found
CVE-2020-27605: Undefined Security Weakness
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."...
CVE-2020-27612: Exposure of Sensitive Information to an Unauthorized Actor
Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to outsiders if any user publishes a screenshot of a browser window...
CVE-2020-26163
BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...
CVE-2020-26163
BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...
Design/Logic Flaw
BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...
CVE-2020-26163
BigBlueButton Greenlight before 2.5.6 is affected by an HTTP header (Host and Origin) input issue that enables account takeover when a user clicks a spoofed password‑reset link. Root cause: header handling allows spoofing of origins/hosts. Impact: potential account compromise; attacks require net...
CVE-2020-26163
BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...
CVE-2020-26163: Undefined Security Weakness
BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...
PT-2020-16320
Name of the Vulnerable Software and Affected Versions BigBlueButton Greenlight versions prior to 2.5.6 Description The issue allows HTTP header attacks, specifically targeting the Host and Origin headers, which can lead to account takeover. This can occur when a victim follows a spoofed...
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
Directory traversal
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
CVE-2020-12443
CVE-2020-12443 affects BigBlueButton before 2.2.6, allowing remote read of files via directory traversal: presfilename (lowercase) can be a .pdf while presFilename (mixed case) contains ../, enabling traversal to bigbluebutton.properties. The issue ties to an ineffective mitigation for CVE-2020-1...
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
CVE-2020-12443: Improper Limitation of a Pathname to a Restricted Directory
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
BigBlueButton Information Disclosure Vulnerability
BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A security vulnerability exists in BigBlueButton versions prior to 2.2.5. A remote attacker can exploit the vulnerability to obtain sensitive information...
BigBlueButton Cross-Site Scripting Vulnerability
BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton versions prior to 2.2.4. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...
CVE-2020-12113
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...