711 matches found
CVE-2020-12112
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...
Design/Logic Flaw
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...
Cross site scripting
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...
CVE-2020-12112
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...
CVE-2020-12112
BigBlueButton had an LFI/vulnerability in versions before 2.2.5 (CVE-2020-12112). Connected sources also describe a related issue (CVE-2020-12443) where case-insensitive handling of presFilename/presfilename enables directory traversal to bigbluebutton.properties, enabling reading of arbitrary fi...
CVE-2020-12113
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...
CVE-2020-12113
BigBlueButton is affected by CVE-2020-12113: prior to version 2.2.4, the Web UI is vulnerable to cross-site scripting via closed captions because dangerouslySetInnerHTML is used in React. This vulnerability allows XSS as described in multiple sources (e.g., BigBlueButton’s 2.2.4 release notes and...
CVE-2020-12112: Improper Limitation of a Pathname to a Restricted Directory
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion...
CVE-2020-12113: Improper Neutralization of Input During Web Page Generation
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...
PT-2020-13043 · Bigbluebutton · Bigbluebutton
Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.5 Description: The issue allows remote attackers to obtain sensitive files via Local File Inclusion. Recommendations: For versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue...
