Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
77 results · page 2 of 2
Jun 1, 2022BigBlueButton is an open source web conferencing system.CVE-2022-29235 · Other software · bigbluebutton · reported by GitHubMedium 5.3
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.
- Product
- bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2022BigBlueButton is an open source web conferencing system.CVE-2022-29234 · Other software · bigbluebutton · reported by GitHubMedium 4.3
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.
- Product
- bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2022BigBlueButton is an open source web conferencing system.CVE-2022-29233 · Other software · bigbluebutton · reported by GitHubMedium 4.3
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.
- Product
- bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2022BigBlueButton is an open source web conferencing system.CVE-2022-29232 · Other software · bigbluebutton · reported by GitHubMedium 6.5
BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a meeting on the server. BigBlueButton versions 2.3.9 and 2.4-beta-1 contain a patch for this issue. There are currently no known workarounds.
- Product
- bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2022BigBlueButton is an open source web conferencing system.CVE-2022-29169 · Other software · bigbluebutton · reported by GitHubHigh 7.5
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.
- Product
- bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.CVE-2021-4143 · Other software · bigbluebutton · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
- Product
- bigbluebutton/bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2020An issue was discovered in BigBlueButton through 2.2.29.CVE-2020-29043 · Other software · Bigbluebutton · reported by MITREHigh 7.5
An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Nov 26, 2020An issue was discovered in BigBlueButton through 2.2.29.CVE-2020-29042 · Other software · Bigbluebutton · reported by MITRELow 3.7
An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Nov 19, 2020web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a uCVE-2020-28954 · Other software · Bigbluebutton · reported by MITREMedium 5.3
web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020In BigBlueButton before 2.2.29, a user can vote more than once in a single poll.CVE-2020-28953 · Other software · Bigbluebutton · reported by MITREMedium 4.3
In BigBlueButton before 2.2.29, a user can vote more than once in a single poll.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2020A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.CVE-2020-27642 · Other software · Bigbluebutton · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.
- Product
- Greenlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FCVE-2020-27613 · Other software · Bigbluebutton · reported by MITREHigh 8.4
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an informatiCVE-2020-27612 · Other software · Bigbluebutton · reported by MITREMedium 4.3
Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to outsiders if any user publishes a screenshot of a browser window.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bigbluebutton.orgdocs.bigbluebutton.org
Oct 21, 2020BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.CVE-2020-27611 · Other software · Bigbluebutton · reported by MITREHigh 7.3
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bigbluebutton.orggithub.com
Oct 21, 2020The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set uCVE-2020-27610 · Other software · Bigbluebutton · reported by MITREHigh 7.5
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface.CVE-2020-27609 · Other software · Bigbluebutton · reported by MITREMedium 5.3
BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bigbluebutton.orggolem.de
Oct 21, 2020In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .pCVE-2020-27608 · Other software · Bigbluebutton · reported by MITREMedium 6.1
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client.CVE-2020-27607 · Other software · Bigbluebutton · reported by MITREMedium 6.5
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or transmit it to one or more meeting participants or other third parties.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to CVE-2020-27606 · Other software · Bigbluebutton · reported by MITREMedium 5.3
BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache SandboCVE-2020-27605 · Other software · Bigbluebutton · reported by MITRECritical 9.8
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020BigBlueButton before 2.3 does not implement LibreOffice sandboxing.CVE-2020-27604 · Other software · Bigbluebutton · reported by MITREMedium 6.5
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bigbluebutton.orggolem.de
Oct 21, 2020BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.CVE-2020-27603 · Other software · Bigbluebutton · reported by MITREHigh 7.5
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URLCVE-2020-25820 · Other software · Bigbluebutton · reported by MITREMedium 6.5
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 30, 2020BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-CVE-2020-26163 · Other software · Bigbluebutton · reported by MITREHigh 8.8
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.
- Product
- Greenlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2020BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilenCVE-2020-12443 · Other software · Bigbluebutton · reported by MITRECritical 9.8
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2020BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.CVE-2020-12113 · Other software · Bigbluebutton · reported by MITREMedium 6.1
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2020BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.CVE-2020-12112 · Other software · Bigbluebutton · reported by MITREHigh 7.5
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.