CVE-2023-29381

The CVE-2023-29381 entry concerns Zimbra Collaboration (ZCS) versions 8.8.15 and 9.0, where a remote attacker can escalate privileges and disclose sensitive information via the password and 2FA parameters. Multiple connected sources (Red Hat, PT-Security, and related CVE aggregates) confirm the a...

CVE-2023-29381

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-36816

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

CVE-2023-36816

The CVE concerns the 2FAuth web application, where an XSS vulnerability exists in the account/service field. According to the provided records, the issue was demonstrated in a docker-compose test environment and has been patched as of version 4.0.3. The root cause is an input handling flaw that a...

CVE-2023-36816 Cross-Site Scripting (XSS) at Account creation in 2FAuth

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

Brute Force Attack

froxlor/froxlor is vulnerable to Brute Force Attacks. The vulnerability exists because it does not limit 2FA attempts, which allows an attacker to brute force the user credentials and perform unauthorized actions...

Over 100,000 Stolen ChatGPT Account Credentials Sold on Dark Web Marketplaces

Over 101,100 compromised OpenAI ChatGPT account credentials have found their way on illicit dark web marketplaces between June 2022 and May 2023, with India alone accounting for 12,632 stolen credentials. The credentials were discovered within information stealer logs made available for sale on t...

Information stealer compromises legitimate sites to attack other sites

Security researchers at Akamai have published a blog about a new Magecart-alike web skimming campaign that uses compromised legitimate sites as command and control C2 servers. A web skimmer is a piece of malicious code embedded in web payment pages to steal personally identifiable information PII...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

Authentication flaw

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2023-34228

JetBrains TeamCity versions prior to 2023.05 are affected by an authentication issue where 2FA was not checked for certain sensitive account actions. This is confirmed across multiple sources (CVE-2023-34228, Red Hat, PT-2023-24753, Nessus, etc.). The root cause is missing authentication checks b...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2022-36249

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

Code injection

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

CVE-2022-36249 Shop Beat Services Vulnerable To Bypass 2FA via APIs

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

CVE-2022-36249

Shop Beat Media Player v2.5.95–v3.2.57 is affected by a vulnerability that allows bypassing secondary authentication (2FA) at the API level. After login, an attacker can use a bearer token or jsession ID to access APIs without entering the 2FA code, specifically impacting Controlpanel Lite. Root ...

CVE-2023-24605

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...

Code injection

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...

CVE-2023-24605

OX App Suite (Open-Xchange) before backend 7.10.6-rev37 does not enforce two-factor authentication on all endpoints, enabling potential unauthorized access to sensitive data via endpoints such as reading from a drive, reading contact data, and token renaming. The issue is described across multipl...

CVE-2023-24605

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...