Priority HIGH 75
BigBlueButton is an open-source virtual classroom.
bigbluebutton
Records67All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9
Exploited now
bigbluebutton records in CISA KEVNo bigbluebutton vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
67 records
Priority HIGH 72
BigBlueButton is an open-source virtual classroom.
Priority HIGH 72
BigBlueButton is an open-source virtual classroom.
Priority MEDIUM 62
BigBlueButton is an open source web conferencing system.
TI-2020-09954 CVE-2020-12443 · GHSA-hp96-66jq-q83w
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the…
Priority MEDIUM 48
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence.
Priority MEDIUM 47
Greenlight is an end-user interface for BigBlueButton servers.
Priority MEDIUM 47
Greenlight is an end-user interface for BigBlueButton servers.
TI-2020-16722 CVE-2020-27605 · GHSA-wrr2-2733-26wf
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents…
Priority MEDIUM 45
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
TI-2020-16719 CVE-2020-27602 · GHSA-6wv2-qrc6-q345
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection…
Priority MEDIUM 45
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
Priority MEDIUM 42
BigBlueButton is an open source web conferencing system.
TI-2020-15815 CVE-2020-25820 · GHSA-5mrj-23w8-w7hx
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and…
Priority MEDIUM 42
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
TI-2020-15996 CVE-2020-26163 · GHSA-5wp7-85p7-qq6v
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which…
Priority MEDIUM 41
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.
TI-2020-09747 CVE-2020-12112 · GHSA-wvwr-5mqr-9r9p
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
Priority MEDIUM 41
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
Priority LOW 39
BigBlueButton is an open-source virtual classroom.
Priority LOW 38
BigBlueButton is an open-source virtual classroom.
Priority LOW 38
BigBlueButton is an open-source virtual classroom.
TI-2026-34068 CVE-2026-46351
BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
Priority LOW 38
BigBlueButton is an open-source virtual classroom.
TI-2020-16720 CVE-2020-27603 · GHSA-6495-493q-rhcr
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice…
Priority LOW 38
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.
TI-2020-17542 CVE-2020-29043 · GHSA-9vxc-xx4f-gp2p
An issue was discovered in BigBlueButton through 2.2.29.
Priority LOW 36
An issue was discovered in BigBlueButton through 2.2.29.
TI-2020-16730 CVE-2020-27613 · GHSA-6h86-pp56-mp6m
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as…
Priority LOW 36
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access.
TI-2020-16727 CVE-2020-27610 · GHSA-ff26-q46j-34gx
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain…
Priority LOW 35
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access.
TI-2022-07548 CVE-2022-23488
BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data
Priority LOW 34
BigBlueButton is an open source web conferencing system.
TI-2020-16728 CVE-2020-27611 · GHSA-2pxm-qg5m-jmf9
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
Priority LOW 33
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
TI-2026-34072 CVE-2026-46355
BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
Priority LOW 31
BigBlueButton is an open-source virtual classroom.
Priority LOW 31
BigBlueButton is an open-source virtual classroom.