PT-2023-27134 · Unknown · Schoolmate

Name of the Vulnerable Software and Affected Versions: Schoolmate version 1.3 Description: The issue is related to multiple SQL injection vulnerabilities. These vulnerabilities can be exploited via the $courseid and $teacherid parameters at the DeleteFunctions.php file. There is no information...

Voodoo Chat 1.3 Cross Site Scripting

==================================================================================================================================== | Title : Voodoo Chat v1.3 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.332-bit | | Vendor :...

WebCalendar 1.3 Cross Site Request Forgery

==================================================================================================================================== | Title : WebCalendar v1.3 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendor :...

CVE-2023-3724

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

Input validation

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724

This CVE (CVE-2023-3724) describes a TLS 1.3 client-side issue where, if a server is malicious and the client sends neither a PSK nor a KSE, a default, potentially known, IKM buffer is used to generate the session master secret. The root cause is a mishandled IKM when PSK/KSE are absent, which ca...

CVE-2023-3724

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724 TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724 TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

PT-2023-25848 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL affected versions not specified Description: When a TLS 1.3 client connects to a malicious server without receiving a PSK pre shared key extension or a KSE key share extension, it uses a default predictable buffer for the IKM Input...

PT-2023-22503 · Unknown · Debut Web Server

Name of the Vulnerable Software and Affected Versions: Debut web server versions 1.2 through 1.3 Description: A null pointer dereference issue exists, which can lead to a denial-of-service DoS condition when a specially crafted request is processed. The issue affects multiple vendors' MFPs and...

Debian dla-3487 : fusiondirectory - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3487 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3487-1 [email protected]...

PT-2023-7453 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions 1.3 through 3.5.8 Mastodon versions 4.0.0 through 4.0.4 Mastodon versions 4.1.0 through 4.1.2 Description: The issue is related to the processing of oEmbed data in Mastodon, which can allow an attacker to bypass HTML...

Turnitin LTI 跨站脚本漏洞

Turnitin LTI is the modern standard for integrating third-party tools with virtual learning environments. A security vulnerability exists in Turnitin LTI version 1.3 that stems from the vulnerability of the Submission Web Form to HTML injection attacks...

PT-2023-25018 · Turnitin · Turnitin Lti Tool

Name of the Vulnerable Software and Affected Versions: Turnitin LTI tool/plugin version 1.3 Description: The issue affects the "Submission Web Form" of the Turnitin LTI tool/plugin, where students submit their reports for similarity/plagiarism checks. Specifically, the submission web form is...

WordPress Caldera Forms Google Sheets Connector Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Caldera Forms Google Sheets Connector Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2330 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 989c25f04825 Credits...

CVE-2023-29707

Cross Site Scripting XSS vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device...

Synology Router Manager (SRM) 1.2.x, 1.3.x Uncontrolled Search Path Element Privilege Escalation Vulnerability (Synology-SA-23:06)

Synology Router Manager SRM is prone to an uncontrolled search path element privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...