226 matches found
Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting
Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application. id: CVE-2021-26812 info: name: Moodle...
Malicious code in lib-jitsi-meet-sample (npm)
Source: ossf-package-analysis 0247e3f2877ee9dba4689c00ae13db004afaea694957dfb979bf3cfbd1ef9e31 The OpenSSF Package Analysis project identified 'lib-jitsi-meet-sample' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with maliciou...
CVE-2026-92299
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
EUVD-2026-80079
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-92299
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-92299
@jitsi/electron-sdk (the Electron-based desktop client for Jitsi Meet) prior to 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker. This allows any script running in the meeting page to call the jitsi-screen-sharing-get-sources IPC route and ...
PT-2026-93258
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-92299: Missing Authorization
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
Malicious code in jitsi-meet-load-test (npm)
Source: ossf-package-analysis 4d8d6095bca0d534688b13d2823e401a9d42de4a2fc1fdc8c9bd1be3b147b746 The OpenSSF Package Analysis project identified 'jitsi-meet-load-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...
Malicious code in jitsi-meet-electron (npm)
Source: ossf-package-analysis 1d00022cc6b75ddc259b9fe60993dbdf646c17b30cce6a76c88798ca229947db The OpenSSF Package Analysis project identified 'jitsi-meet-electron' @ 99.99.99 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...
Malicious code in jitsi-meet-logger (npm)
The package jitsi-meet-logger was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in eslint-config-jitsi (npm)
The package eslint-config-jitsi was found to contain malicious code. --- Credit: OpenSSF source...
Jitsi Meet Page Detect
Jitsi was detected — a free open-source video conferencing software for web and mobile. !/usr/bin/env python3 -- coding: utf-8 -- """Jitsi was detected — a free open-source video conferencing software for web and mobile.""" from kittysploit import from lib.protocols.http.httpclient import...
Malicious Package
Overview jitsi-meet-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...
