Priority HIGH 75
BigBlueButton is an open-source virtual classroom.
bigbluebutton
Records67All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9
Exploited now
bigbluebutton records in CISA KEVNo bigbluebutton vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
49 records in Bigbluebutton · all components
Priority HIGH 72
BigBlueButton is an open-source virtual classroom.
Priority HIGH 72
BigBlueButton is an open-source virtual classroom.
Priority MEDIUM 62
BigBlueButton is an open source web conferencing system.
TI-2020-09954 CVE-2020-12443 · GHSA-hp96-66jq-q83w
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the…
Priority MEDIUM 48
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence.
TI-2020-16722 CVE-2020-27605 · GHSA-wrr2-2733-26wf
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents…
Priority MEDIUM 45
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
TI-2020-16719 CVE-2020-27602 · GHSA-6wv2-qrc6-q345
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection…
Priority MEDIUM 45
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
Priority MEDIUM 42
BigBlueButton is an open source web conferencing system.
TI-2020-15815 CVE-2020-25820 · GHSA-5mrj-23w8-w7hx
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and…
Priority MEDIUM 42
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
TI-2020-09747 CVE-2020-12112 · GHSA-wvwr-5mqr-9r9p
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
Priority MEDIUM 41
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
Priority LOW 39
BigBlueButton is an open-source virtual classroom.
TI-2020-16720 CVE-2020-27603 · GHSA-6495-493q-rhcr
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice…
Priority LOW 38
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.
TI-2020-17542 CVE-2020-29043 · GHSA-9vxc-xx4f-gp2p
An issue was discovered in BigBlueButton through 2.2.29.
Priority LOW 36
An issue was discovered in BigBlueButton through 2.2.29.
TI-2020-16730 CVE-2020-27613 · GHSA-6h86-pp56-mp6m
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as…
Priority LOW 36
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access.
TI-2020-16727 CVE-2020-27610 · GHSA-ff26-q46j-34gx
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain…
Priority LOW 35
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access.
TI-2022-07548 CVE-2022-23488
BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data
Priority LOW 34
BigBlueButton is an open source web conferencing system.
TI-2020-16728 CVE-2020-27611 · GHSA-2pxm-qg5m-jmf9
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
Priority LOW 33
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
Priority LOW 31
BigBlueButton is an open-source virtual classroom.
Priority LOW 31
BigBlueButton is an open source web conferencing system.
TI-2020-16721 CVE-2020-27604 · GHSA-63xf-x242-85mq
BigBlueButton before 2.3 does not implement LibreOffice sandboxing.
Priority LOW 31
BigBlueButton before 2.3 does not implement LibreOffice sandboxing.
Priority LOW 30
BigBlueButton is an open source web conferencing system.
TI-2020-16724 CVE-2020-27607 · GHSA-57h6-vpq8-cwg3
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies…
Priority LOW 30
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client.
Priority LOW 29
BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn.
TI-2021-03017 CVE-2021-4143 · GHSA-rq88-x89h-6r64
Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton
Priority LOW 29
Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
TI-2020-16725 CVE-2020-27608 · GHSA-43wq-r34m-56ch
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients…
Priority LOW 29
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.