1472 matches found
CVE-2024-9687
The CVE-2024-9687 vulnerability affects WP 2FA with Telegram for WordPress in versions up to 3.0. Root cause: insufficient validation of the user-controlled key on the validate_tg action, enabling authentication bypass for authenticated users with subscriber-level permissions and above to log in ...
WordPress WP 2FA with Telegram Plugin <= 3.0 is vulnerable to Bypass Vulnerability
Software WP 2FA with Telegram Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-9820 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID ed4d0a1bac8d Credits István Márton Required privilege...
CVE-2024-9687: Authorization Bypass Through User-Controlled Key
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...
WordPress WP 2FA with Telegram Plugin <= 3.0 is vulnerable to Broken Authentication
Software WP 2FA with Telegram Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9687 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID c6f09889bfbf Credits István...
CVE-2024-9820: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication...
PT-2024-39865
Name of the Vulnerable Software and Affected Versions WP 2FA with Telegram plugin for WordPress versions up to, and including, 3.0 Description The issue is related to Two-Factor Authentication Bypass. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass...
CVE-2024-48941
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted...
CVE-2024-48942
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...
CVE-2024-48942: Improper Control of Interaction Frequency
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...
CVE-2024-48941: Incorrect Privilege Assignment
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted...
Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks
Microsoft is warning of cyber attack campaigns that abuse legitimate file hosting services such as SharePoint, OneDrive, and Dropbox that are widely used in enterprise environments as a defense evasion tactic. The end goal of the campaigns are broad and varied, allowing threat actors to compromis...
CVE-2024-48942
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket (versions 3.1.4.5 and earlier ) is vulnerable to a brute-force attack against the 2FA PIN. The root cause is that the plugins/servlet/twofactor/public/pinvalidation endpoint accepts the last 30 and next 30 tokens as valid, ...
CVE-2024-48941
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted...
CVE-2024-48941
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted...
CVE-2024-48942
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...
CVE-2024-48942
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...
CVE-2024-48941
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket (versions through 3.1.4.5 ) contains a vulnerability that allows remote attackers to bypass two-factor authentication (2FA) . The root cause is an insecure default configuration where the /rest endpoint is allowlisted, enab...
PT-2024-33287
Name of the Vulnerable Software and Affected Versions Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket versions 3.1.4.5 and earlier Description The issue allows remote attackers to bypass 2-factor authentication by interacting with the "/rest" endpoint of Jira, Confluence, or...
GHSA-WC43-73W7-X2F5 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials
Preconditions - The code login method is enabled with the passwordlessenabled flag set to true . - A 2FA method such as totp is enabled. - requiredaal of the whomai check or the settings flow is set to highestavailable. AAL stands for Authenticator Assurance Levels and can range from 0 no factor ...
