CVE Daily – Greenlight https://cvedaily.com/pages/tags/greenlight.html CVE Daily – Greenlight en Wed, 03 Jun 2026 21:27:08 +0000 [Critical] CVE-2022-36029 – Greenlight is an end-user interface for BigBlueButton servers. Versions prior to... https://nvd.nist.gov/vuln/detail/CVE-2022-36029 https://nvd.nist.gov/vuln/detail/CVE-2022-36029 Thu, 25 Apr 2024 21:15:46 +0000 Critical CVE-2022-36029

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

CVSS: 9.1 · CWE: CWE-601

View on NVD

]]> [Critical] CVE-2022-36028 – Greenlight is an end-user interface for BigBlueButton servers. Versions prior to... https://nvd.nist.gov/vuln/detail/CVE-2022-36028 https://nvd.nist.gov/vuln/detail/CVE-2022-36028 Thu, 25 Apr 2024 21:15:46 +0000 Critical CVE-2022-36028

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

CVSS: 9.1 · CWE: CWE-601

View on NVD

]]> [Medium] CVE-2022-31039 – Greenlight is a simple front-end interface for your BigBlueButton server. In aff... https://nvd.nist.gov/vuln/detail/CVE-2022-31039 https://nvd.nist.gov/vuln/detail/CVE-2022-31039 Mon, 27 Jun 2022 20:15:08 +0000 Medium CVE-2022-31039

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.

CVSS: 4.3 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2022-26497 – BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username... https://nvd.nist.gov/vuln/detail/CVE-2022-26497 https://nvd.nist.gov/vuln/detail/CVE-2022-26497 Thu, 02 Jun 2022 18:15:09 +0000 Medium CVE-2022-26497

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2020-27642 – A cross-site scripting (XSS) vulnerability exists in the 'merge account' functio... https://nvd.nist.gov/vuln/detail/CVE-2020-27642 https://nvd.nist.gov/vuln/detail/CVE-2020-27642 Thu, 22 Oct 2020 13:15:15 +0000 Medium CVE-2020-27642

A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2020-27612 – Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which ... https://nvd.nist.gov/vuln/detail/CVE-2020-27612 https://nvd.nist.gov/vuln/detail/CVE-2020-27612 Wed, 21 Oct 2020 15:15:27 +0000 Medium CVE-2020-27612

Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to outsiders if any user publishes a screenshot of a browser window.

CVSS: 4.3 · CWE: CWE-200

View on NVD

]]> [High] CVE-2020-26163 – BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attac... https://nvd.nist.gov/vuln/detail/CVE-2020-26163 https://nvd.nist.gov/vuln/detail/CVE-2020-26163 Wed, 30 Sep 2020 18:15:27 +0000 High CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.

CVSS: 8.8 · CWE: N/A

View on NVD

]]>