CVE-2021-39215

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

CVE-2021-39215 Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

CVE-2021-39215

Jitsi Meet prior to version 2.0.5963 is vulnerable: a Prosody module permits using symmetric algorithms to validate JSON Web Tokens, allowing tokens created by any source to authorize access to protected rooms. The issue is fixed in Jitsi Meet 2.0.5963. There are no publicly documented workaround...

CVE-2021-39205

CVE-2021-39205 affects Jitsi Meet up to version 2.0.6173. The issue is a client-side cross-site scripting vulnerability caused by injecting properties into JSON objects that were not properly escaped. Impact is described as a potential for script execution in the browser context of the user, with...

CVE-2021-39205 DOM-based XSS/Content Spoofing via Prototype Pollution

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the...

Jitsi Meet 跨站脚本漏洞

Jitsi Meet is is a set of open source projects. Enabling users to use and deploy a video conferencing platform with state-of-the-art video quality and features. A cross-site scripting vulnerability exists in versions prior to Jitsi Meet 2.0.6173, which stems from software that injects attributes...

PT-2021-22457 · Unknown · Jitsi Meet

Name of the Vulnerable Software and Affected Versions: Jitsi Meet versions prior to 2.0.6173 Description: Jitsi Meet is an open source video conferencing application. The issue arises from client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped...

Jitsi Meet 授权问题漏洞

Jitsi Meet is is a set of open source projects. Enabling users to use and deploy a video conferencing platform with state-of-the-art video quality and features. A vulnerability in authorization issues exists in versions prior to Jitsi Meet 2.0.5963, which stems from the Prosody module allowing th...

Unspecified Vulnerability in Jitsi Meet jitsi-meet-prosody

8X8 Docker Jitsi Meet is a tool for building Jitsi Meet videoconferencing solutions in Docker from 8x8 USA. A security vulnerability exists in jitsi-meet-prosody in versions of Jitsi Meet prior to 5026, which stems from an uncertainty in the default setting of restrictroomcreation. No detailed...

8x8: [jitsi-meet] Authentication Bypass when using JWT w/ public keys

A Prosody module allows the use of symmetrical algorithms to validate JWTs. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. There are no known incidents related to this vulnerability. Please refer to the published advisory:...

CVE-2021-33506

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

Design/Logic Flaw

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

CVE-2021-33506

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

CVE-2021-33506

CVE-2021-33506 affects jitsi-meet-prosody in Jitsi Meet prior to 2.0.5963-1, where restrict_room_creation is not enabled by default. This misconfiguration can allow an attacker to circumvent conference moderation. Connected sources confirm the issue across multiple vectors (Red Hat CVE page and C...

CVE-2021-33506

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

Jitsi Meet jitsi-meet-prosody安全漏洞

8X8 Docker Jitsi Meet is a tool for building Jitsi Meet videoconferencing solutions in Docker from 8x8 USA. A security vulnerability exists in jitsi-meet-prosody in versions of Jitsi Meet prior to 5026, which stems from an uncertainty in the default setting of restrictroomcreation. No detailed...

CVE-2021-26812

Cross Site Scripting XSS in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application...

CVE-2021-26812

Cross Site Scripting XSS in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application...

Cross site scripting

Cross Site Scripting XSS in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application...

CVE-2021-26812

Cross Site Scripting XSS in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application...