BigBlueButton Unrestricted File Upload vulnerability

BigBlueButton: Blind SQL Injection AUTH (Moderator)

The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access

BigBlueButton: Exposed ClamAV port enables Denial of Service

BigBlueButton API checksum bypass via presentationUploadExternalUrl

BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them

BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId

BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation

BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data

ReDoS on endpoint html5client/useragent in BigBlueButton

An issue was discovered in BigBlueButton through 2.2.29

The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall…

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion

BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint

BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser