145 matches found
CVE-2025-20190
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...
CVE-2025-20186
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to...
CVE-2025-20190
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...
CVE-2025-20186
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to...
CVE-2025-20190
CVE-2025-20190 affects Cisco IOS XE Wireless Controller Software. The vulnerability lies in the lobby ambassador web interface/API, where insufficient access control allows an authenticated lobby ambassador user to delete arbitrary user accounts (including admin accounts). Exploitation requires v...
CVE-2025-20190
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...
Cisco IOS XE Wireless Controller Software Unauthorized User Deletion Vulnerability
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...
Cisco IOS XE Software Web-Based Management Interface Command Injection Vulnerability
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to...
PT-2025-20262 · Cisco · Cisco Ios Xe Wireless Controller
Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Wireless Controller Software affected versions not specified Description: A vulnerability in the lobby ambassador web interface could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affect...
CVE-2024-33530
In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings that make use of a lobby leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby...
Jitsi Meet 安全漏洞
Jitsi Meet is a group of open source projects enabling users to use and deploy a video conferencing platform with state-of-the-art video quality and features. A security vulnerability exists in versions prior to Jitsi Meet 9391 that stems from allowing the meeting password to be disclosed when...
Cross site scripting
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
BigBlueButton Cross-Site Scripting Vulnerability
BigBlueButton is an open source web conferencing system from the BigBlueButton community. A cross-site scripting vulnerability exists in BigBlueButton versions prior to 2.6.11, and prior to 2.7.0-beta.3, which stems from a cross-site scripting XSS vulnerability in Guest Lobby...
PT-2023-28989 · Unknown · Bigbluebutton
Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.11 BigBlueButton versions prior to 2.7.0-beta.3 Description: The issue affects BigBlueButton, an open-source virtual classroom, where the Guest Lobby is vulnerable to cross-site scripting. This occurs when...
CVE-2023-44275
OPNsense before 23.7.5 allows XSS via the index.php columncount parameter to the Lobby Dashboard...
