950 matches found
HackerOne: Improper Authentication - 2FA OTP Reusable
Vulnerability description not provided...
HackerOne: 2FA requirement bypass when claiming bounty
Vulnerability description not provided...
Brazilian Banks Targeted by New AllaKore RAT Variant Called AllaSenha
Brazilian banking institutions are the target of a new campaign that distributes a custom variant of the Windows-based AllaKore remote access trojan RAT called AllaSenha. The malware is "specifically aimed at stealing credentials that are required to access Brazilian bank accounts, and leverages...
scheb/two-factor-bundle bypass two-factor authentication with remember-me option
In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication 2FA using the rememberme cookie. When the rememberme checkbox was used during login, a "REMEMBERME" cookie was created. Upon...
GitLab 8.7 < 13.1.10 / 13.2 < 13.2.8 / 13.3 < 13.3.4 (CVE-2020-13289)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated. CVE-2020-13289 Note that Nessus has n...
CVE-2024-34082 Grav Arbitrary File Read to Account Takeover
Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...
HackerOne: Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery
Vulnerability description not provided...
Google Simplifies 2-Factor Authentication Setup (It's More Important Than Ever)
Google on Monday announced that it's simplifying the process of enabling two-factor authentication 2FA for users with personal and Workspace accounts. Also called 2-Step Verification 2SV, it aims to add an extra layer of security to users' accounts to prevent takeover attacks in case the password...
HackerOne: Reset the 2FA of the user which can lead to Account Takeover
Vulnerability description not provided...
CVE-2023-3597
A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication...
HackerOne: Session Not Expire / 2FA Bypass
Vulnerability description not provided...
CVE-2024-32568
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n/a through = 2.6.2...
CVE-2024-32568 WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP 2FA allows Reflected XSS.This issue affects WP 2FA: from n/a through 2.6.2...
CVE-2024-32568 WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n/a through = 2.6.2...
CVE-2024-32568
The CVE-2024-32568 entry concerns Melapress WP 2FA with a Reflected XSS due to improper input neutralization in web page generation. Affected versions are from n/a through 2.6.2. The provided documents do not specify a vendor, product build, or a confirmed patch/mitigation. No exploit details or ...
PT-2024-24689 · Melapress · Melapress Wp 2Fa
Name of the Vulnerable Software and Affected Versions: Melapress WP 2FA versions n/a through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...
WordPress WP 2FA Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)
Software WP 2FA Type Plugin Vulnerable versions = 2.6.2 Fixed in 2.6.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32568 Patch priority Medium CVSS severity Medium 7.1 Developer Melapress PSID d4b67294d441 Credits Rafie Muhammad Patchstack Required privilege...
HackerOne: 2fa can't be activated on app.pullrequest.com
Vulnerability description not provided...