951 matches found
Improper Authorization in hdinnovations/unit3d-community-edition
Description 2FA bypass in in chat functions. The "twostep" middleware is not implemented under the vue.php routing. Proof of Concept 1: Login into account with 2FA. Do not complete the 2FA process. 2: See all chat messages at https://UNIT3D-URL/api/chat/messages/1 3: If the CSRF token does not...
Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild
No fewer than 1,220 Man-in-the-Middle MitM phishing websites have been discovered as targeting popular online services like Instagram, Google, PayPal, Apple, Twitter, and LinkedIn with the goal of hijacking users' credentials and carrying out further follow-on attacks. The findings come from a ne...
Evernote: Email Verification Bypass by bruteforcing when setting up 2FA
Summary: Hello team, I hope you are fine and doing well when a user set ups his 2 Factor Authentication in his account and verify his email ,i was able to bruteforce the email verification process . The confirmationCode is used for authentication of user's email and it can be brute forced. The co...
Ecommerce - Two Factor Authentication < 1.0.5 - Reflected Cross-Site Scripting
The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue PoC v v 1.0.5: https://example.com/wp-admin/users.php?page=reset=resetedit=" style=animation-name:rotation...
Why is Cybersecurity Failing Against Ransomware?
Yes, security is hard – no one is ever 100 percent safe from the threats lurking out there. But how is it that time and time again, companies – big companies – are continuing to fall for ransomware attacks? Why aren’t we getting any better at preventing them? Let’s explore the main reasons why,...
How to Switch From Google Authenticator to Another 2FA App
Yes, you can choose another two-factor authentication app without getting locked out of your accounts...
Google warns some users that FancyBear’s been prowling around
APT28, also known as FancyBear, is at the heart of another targeted campaign. This time, it’s sniffing around users of Google services. Some 14,000 people have been notified about a spear phish attempt looking to compromise accounts and access their files. When did this happen? Sometime late...
CVE-2021-41129
CVE-2021-41129 affects Pterodactyl Panel. A validation flaw in the two‑factor authentication flow (LoginCheckpointController@__invoke) allows a malicious user to alter the confirmation_token to reference a cache entry containing a user_id, potentially authenticating as an arbitrary user with two‑...
FreeBSD : Gitlab -- vulnerabilities (1bdd4db6-2223-11ec-91be-001b217b3468)
Gitlab reports : Stored XSS in merge request creation page Denial-of-service attack in Markdown parser Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown DNS Rebinding vulnerability in Gitea importer Exposure of trigger tokens on project exports Improper access control for...
CVE-2021-39874
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...
CVE-2021-39874
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...
CVE-2021-39874
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...
Command injection
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...
CVE-2021-39874
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...
CVE-2021-39874
Removed by vendor...
CVE-2021-39874
CVE-2021-39874 affects GitLab CE/EE (all versions since 11.0) where 2FA enforcement is not honored for git commands. This can permit actions that would normally require 2FA to proceed without it, with the impact reflected as no confidentiality/integrity beyond low integrity and no availability im...
CVE-2021-39879
CVE-2021-39879 describes a vulnerability in GitLab CE/EE (all versions since 7.11.0) where missing authentication allows an attacker with a victim’s session to disable two-factor authentication. The connected documents confirm the issue across multiple sources but do not provide concrete patch/ve...
Hackers exploit 2FA flaw to steal crypto from 6,000 Coinbase users
By Waqas working to reimburse the customers for the funds they have lost and help them regain control of their accounts. Here's what happened. This is a post from HackRead.com Read the original post: Hackers exploit 2FA flaw to steal crypto from 6,000 Coinbase users...
Telegram-powered bots circumvent 2FA
Two-factor authentication is a great way to protect your online accounts, and we always recommend you turn it on. But where users put up walls, you can be sure there are cybercriminals trying to break them down. Yesterday, security intelligence firm, Intel 147, revealed it had noticed an uptick o...
Gitlab -- vulnerabilities
Gitlab reports: Stored XSS in merge request creation page Denial-of-service attack in Markdown parser Stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown DNS Rebinding vulnerability in Gitea importer Exposure of trigger tokens on project exports Improper access control for...