Advisories · Technology
bigbluebutton.
Every CVE that names bigbluebutton among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.9 Medium
BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
- bigbluebutton
- Broken access control
- CVSS 5.4 Medium
BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- bigbluebutton
- Cross-site scripting (XSS)
- CVSS 7.1 High
BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- bigbluebutton
- Authentication bypass
- CVSS 8.5 High
BigBlueButton: Blind SQL Injection AUTH (Moderator)
- bigbluebutton
- SQL injection
- CVSS 8.1 High
BigBlueButton API checksum bypass via presentationUploadExternalUrl
- bigbluebutton
- Broken access control
- CVSS 6.8 Medium
BigBlueButton: Presentation URL Security Hardening
- bigbluebutton
- Server-side request forgery (SSRF)
- CVSS 8.1 High
BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
- bigbluebutton
- Weak cryptography or TLS
- CVSS 6.5 Medium
BigBlueButton has Stored XSS in bbb-playback replay
- bigbluebutton
- blindsidenetworks scalite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
BigBlueButton's missing authorization allows viewer to inject/overwrite captions
- bigbluebutton
- Broken access control
- CVSS 4.3 Medium
BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
- bigbluebutton
- Open redirect
- CVSS 6.1 Medium
BigBlueButton has Open Redirect vulnerability in ApiController
- bigbluebutton
- Open redirect
- CVSS 2.0 Low
BigBlueButton: Audio from participants to the server initially unmuted
- bigbluebutton
- Information disclosure
- CVSS 7.2 High
BigBlueButton: Exposed ClamAV port enables Denial of Service
- bigbluebutton
- Information disclosure
- CVSS 7.5 High
BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
- bigbluebutton
- CWE-703
- CVSS 7.5 High
BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
- bigbluebutton
- CWE-703
- CVSS 7.1 High
BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes
- bigbluebutton
- Cross-site scripting (XSS)
- CVSS 3.7 Low
Some bbb-record-core files installed with wrong file permission
- bigbluebutton
- Privilege escalation
- CVSS 4.6 Medium
bbb-web API additional parameters considered
- bigbluebutton
- Broken access control
- CVSS 5.6 Medium
BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)
- bigbluebutton
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
- bigbluebutton
- Cross-site scripting (XSS)
- CVSS 3.1 Low
BigBlueButton Path Traversal – Reading Certain File Extensions
- bigbluebutton
- Path traversal
- CVSS 5.3 Medium
BigBlueButton Unrestricted File Upload vulnerability
- bigbluebutton
- Unrestricted file upload
- CVSS 4.8 Medium
Blind SSRF When Uploading Presentation in BigBlueButton
- bigbluebutton
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data
- bigbluebutton
- Information disclosure
- CVSS 4.3 Medium
Improper access control to polling votes
- bigbluebutton
- Information disclosure
- Broken access control
- CVSS 5.7 Medium
BigBlueButton contains Response leaks in anonymous polls
- bigbluebutton
- Information disclosure
- CVSS 2.7 Low
BigBlueButton contains Improper Preservation of Permissions for whiteboard
- bigbluebutton
- CWE-281
- CVSS 2.7 Low
BigBlueButton contains Incorrect Authorization for setting emoji status
- bigbluebutton
- Broken access control
- CVSS 4.3 Medium
BigBlueButton subject to Ineffective user bans
- bigbluebutton
- CWE-345
- CWE-346
- CVSS 4.3 Medium
BigBlueButton contains DoS via failed authToken validation
- bigbluebutton
- CWE-345
- CVSS 6.5 Medium
Cross site scripting in username that will trigger by sending chat
- bigbluebutton
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Cross site scripting vulnerability for private chat in bigbluebutton
- bigbluebutton
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Limited data exposure for shared external videos in BigBlueButton
- bigbluebutton
- Information disclosure
- CVSS 4.3 Medium
Improper access control for pencil annotations in BigBlueButton
- bigbluebutton
- Broken access control
- CVSS 4.3 Medium
Grace period for lock settings in public/private chats in BigBlueButton
- bigbluebutton
- Broken access control
- CVSS 4.3 Medium
Improper access control for breakout rooms in BigBlue Button
- bigbluebutton
- Broken access control
- CVSS 6.5 Medium
Exposure of messages in BigBlueButton public chats
- bigbluebutton
- Information disclosure
- CVSS 7.5 High
ReDoS on endpoint html5client/useragent in BigBlueButton
- bigbluebutton
- CWE-20