The Digital Citizen’s Guide to Navigating Cyber Conflict

As security professionals, we are currently being bombarded with warnings and alerts of a heightened threat level due to the possibility that Russia will start to more aggressively leverage cyberattacks as part of their offensive. If you are feeling the pressure of getting everything done, check...

Fortinet FortiToken Mobile Access Control Error Vulnerability

Fortinet FortiToken Mobile is an Oath-compliant, event-based and time-based one-time password Otp generator application from Fortinet U.S.A. An access control error vulnerability exists in Fortinet FortiToken Mobile versions 5.1.0 and below, which stems from a network system or the product does n...

TeaBot Trojan Haunts Google Play Store, Again

The TeaBot banking trojan – also known as “Anatsa” – has been spotted on the Google Play store, researchers from Cleafy have discovered. The malware – designed to intercept SMS messages and login credentials from unwitting users – affected users of “more than 400 banking and financial apps,...

CVE-2021-44166

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...

Improper access control

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...

CVE-2021-44166

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...

CVE-2021-44166

Summary: CVE-2021-44166 affects Fortinet FortiToken Mobile for Android (external push notification, versions ≤ 5.1.0). The root cause is an improper access control (CWE-284) that could allow a remote attacker who already has a user’s password to access the protected system during the 2FA flow, ev...

FortiToken Mobile (Android) - Deny request approved from External push notification

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user...

Basecamp: Improper Authentication via previous backup code login

HI Basecamp, I would like to report Improper Authentication in basecamp. Attacker is able to login at victim account once victim update his password. attacker knows with victims email █████████ password uhn123HH victim updates his password uhn123HHjcc Step To Reproduce ==Attacker== - Step1 attack...

Twitter cans 2FA service provider over surveillance claims

Twitter is transitioning away from from its two-factor authentication 2FA provider, Mitto AG, a Swiss communications company. The social media giant broke the news to US Senator Ron Wyden of Oregon. It is noted that Twitters decision to move away from Mitto AG came after allegations that its...

GHSA-HFMF-Q69J-6M5P Reuse of one time passwords allowed in Gitea

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

Reuse of one time passwords allowed in Gitea

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

Authentication flaw

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45331

The CVE-2021-45331 issue affects Gitea prior to 1.5.0 and is an Authentication Bypass where a malicious user could abuse the TOTP-based 2FA workflow to gain privileges. Root cause is an authentication mechanism flaw that allows submitting a valid TOTP correctly more than once, enabling privilege ...

Microsoft: Slow MFA adoption presents “dangerous mismatch” in security

Multi-factor authentication MFA has been around for many years now, but few enterprises have fully embraced it. In fact, according to Microsofts inaugural "Cyber Signals" report, only 22 percent of all its Azure Active Directory AD enterprise clients have adopted two-factor authentication 2FA, a...

Actor’s verified Twitter profile hijacked to spam NFT giveaways

When we refer to hijacked verified profiles on Twitter, it’s most commonly some sort of Elon Musk themed scam. The hijackers compromise the account, switch the picture to Elon, and then start spamming cryptocurrency links. Alternatively, they may keep the account as it is and spam images claiming...

2FA App Loaded with Banking Trojan Infests 10K Victims via Google Play

After remaining available for more than two weeks, a malicious two-factor authentication 2FA application has been removed from Google Play — but not before it was downloaded more than 10,000 times. The app, which is fully functional as a 2FA authenticator, comes loaded with the Vultur stealer...