jitsi records
7 published records for vendor jitsi.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 14.3%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames1
- CWE-20 Improper Input Validation1
- CWE-345 Insufficient Verification of Data Authenticity1
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password1
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
7 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
53Plan | CVE-2021-26812Proof of concept | Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.jitsi · meet · CWE-79 | Medium6.1 | — | 97.1% | Apr 14, 2021 |
40Plan | CVE-2022-43550No exploit | A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows jitsi · jitsi · CWE-78 | Critical9.8 | — | 1.7% | Feb 9, 2023 |
39Monitor | CVE-2020-11878No exploit | The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.jitsi · meet · CWE-798 | Critical9.8 | — | 1.3% | Apr 17, 2020 |
30Monitor | CVE-2020-25019No exploit | jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is jitsi · meet electron · CWE-345 | High7.5 | — | 1.0% | Aug 29, 2020 |
30Monitor | CVE-2024-33530No exploit | In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meetiCWE-640 | High7.5 | — | 0.7% | May 2, 2024 |
24Monitor | CVE-2022-36736No exploit | Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a craftejitsi · jitsi · CWE-1021 | Medium6.1 | — | 0.7% | Sep 8, 2022 |
23Monitor | CVE-2017-5603No exploit | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includjitsi · jitsi · CWE-20 | Medium5.9 | — | 1.5% | Feb 9, 2017 |
- CVE-2021-2681253Plan
Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.
MediumCVSS 6.1Proof of conceptEPSS 97%jitsi · meetApr 14, 2021
- CVE-2022-4355040Plan
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows
CriticalCVSS 9.8No exploitEPSS 1%jitsi · jitsiFeb 9, 2023
- CVE-2020-1187839Monitor
The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.
CriticalCVSS 9.8No exploitEPSS 1%jitsi · meetApr 17, 2020
- CVE-2020-2501930Monitor
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is
HighCVSS 7.5No exploitEPSS 1%jitsi · meet electronAug 29, 2020
- CVE-2024-3353030Monitor
In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeti
HighCVSS 7.5No exploitEPSS 0%May 2, 2024
- CVE-2022-3673624Monitor
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafte
MediumCVSS 6.1No exploitEPSS 0%jitsi · jitsiSep 8, 2022
- CVE-2017-560323Monitor
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ
MediumCVSS 5.9No exploitEPSS 1%jitsi · jitsiFeb 9, 2017