CVE-2024-33530

In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings that make use of a lobby leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby...

Jitsi Meet 安全漏洞

Jitsi Meet is a group of open source projects enabling users to use and deploy a video conferencing platform with state-of-the-art video quality and features. A security vulnerability exists in versions prior to Jitsi Meet 9391 that stems from allowing the meeting password to be disclosed when...

CVE-2024-33530

CVE-2024-33530 affects Jitsi Meet before version 9391. A logic flaw in password-protected meetings using a lobby can disclose the meeting password when a user is invited to a call after waiting in the lobby. Root cause: flawed handling of lobby/password flow. Impact: confidentiality impact high. ...

Webinar and Video Conference with Jitsi Meet < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Webinar and Video Conference with Jitsi Meet plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-30437

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3...

CVE-2024-30437 WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3...

CVE-2024-30437

CVE-2024-30437 affects WPPOOL Webinar and Video Conference with Jitsi Meet: Improper neutralization of input in web page generation leads to Stored XSS. Affected: Webinar and Video Conference with Jitsi Meet from n/a through version 2.6.3. No exploitation status or patch details are provided in t...

CVE-2024-30437 WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3...

PT-2024-23365 · Unknown · Wppool Webinar/Video Conference With Jitsi Meet

Name of the Vulnerable Software and Affected Versions: WPPOOL Webinar and Video Conference with Jitsi Meet versions n/a through 2.6.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS...

WordPress Plugin Webinar and Video Conference with Jitsi Meet 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Webinar and Video Conference with Jitsi Meet Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Software Webinar and Video Conference with Jitsi Meet Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30437 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1c0351b4d07f Credits LVT-tholv...

Malicious code in jitsi-meet-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d00022cc6b75ddc259b9fe60993dbdf646c17b30cce6a76c88798ca229947db The OpenSSF Package Analysis project identified 'jitsi-meet-electron' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

MAL-2024-1070 Malicious code in jitsi-meet-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d00022cc6b75ddc259b9fe60993dbdf646c17b30cce6a76c88798ca229947db The OpenSSF Package Analysis project identified 'jitsi-meet-electron' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

8x8 Bounty: Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution

The Jitsi VideoBridge failed to properly handle JSON messages with duplicate colibriClass keys, enabling clients to send messages interpreted differently by the bridge and resulting in unauthorized actions within video conferences. Jitsi Security Advisory has been published...

WordPress Webinar and Video Conference with Jitsi Meet Plugin <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Webinar and Video Conference with Jitsi Meet Type Plugin Vulnerable versions = 1.2.5 Fixed in 2.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d77b318b12e...

SUSE CVE-2017-5603

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544...

CVE-2022-43550

A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution...

Command injection

A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution...

CVE-2022-43550

A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution...

CVE-2022-43550

A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution...