CVE-2024-44081

CRITICAL Year: 2024
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-79
View all →

Vulnerability Description

In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format.

Related Vulnerabilities

CVE-2007-4039

CRITICAL
CVSS:9.8(Critical)

Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metach...

CWE-792007

CVE-2017-8898

CRITICAL
CVSS:9.8(Critical)

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses...

CWE-792017

CVE-2018-0403

CRITICAL
CVSS:9.8(Critical)

Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. C...

CWE-792018

CVE-2018-10369

CRITICAL
CVSS:9.8(Critical)

A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices. An attacker can change the Admin Password without a Login.

CWE-792018

CVE-2018-19222

CRITICAL
CVSS:9.8(Critical)

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists.

CWE-792018

CVE-2018-6333

CRITICAL
CVSS:9.8(Critical)

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content insid...

CWE-792018