Rocket.Chat 3.12.1 NoSQL Injection / Code Execution

Title: Rocket.Chat 3.12.1 - NoSQL Injection to RCE Unauthenticated Author: enox Date: 06-06-2021 Product: Rocket.Chat Vendor: https://rocket.chat/ Vulnerable Versions: Rocket.Chat 3.12.1 CVE: CVE-2021-22911 Credits: https://blog.sonarsource.com/nosql-injections-in-rocket-chat !/usr/bin/python...

Nextcloud: No admin audit entry for enabling/disabling 2FA

Related to https://hackerone.com/reports/1177353 When a user enables or disables 2FA there is no entry in the audit log. Impact Especially for disabling it should probably be logged there. But account security related things should be in there...

CVE-2021-31901

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...

Design/Logic Flaw

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...

CVE-2021-31901

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...

CVE-2021-31901

CVE-2021-31901 affects JetBrains Hub prior to version 2021.1.13079. The root cause is that two-factor authentication was not properly enabled for the All Users group, which could allow access issues related to authentication configuration. Public details across connected documents confirm the vul...

Ryuk Ransomware Attack Sprung by Frugal Student

A European biomolecular research institute involved in COVID-19 research lost a week’s worth of research data, all thanks to a Ryuk ransomware attack traced back to a student trying to save money by buying unlicensed software. Security researchers at Sophos described the attack in a report...

CS Money: Previously created sessions continue being valid after MFA activation

Summary: Hi, team. This is the same issue of 667739. Please take a look. I found one issue related to your 2FA system on https://cs.money/security/ Steps To Reproduce: 1. access the same account on https://cs.money/ in two devices 1. on device 'A' go to https://cs.money/security/ complete all ste...

CS Money: Able to blocking users with 2fa from login into their accounts by just knowing the SteamID

A vulnerability was discovered where an attacker could block users with two-factor authentication from logging into their accounts on a website by modifying the steamid cookie in the two-factor authentication code confirmation request. By changing the steamid cookie to the victim's and sending...

CVE-2021-29456

CVE-2021-29456 affects Authelia (open‑source authentication/SSO server). In versions ≤ 4.27.4, an HTTP query parameter permits open redirects to any external domain, enabling potential phishing by spoofing the initial URL. The vulnerability’s impact is limited to redirect behavior, not direct app...

Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Exploit

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ur username : "...

Discourse 2.7.0 2FA Bypass

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Date: 14/01/2021 Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ...

Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Date: 14/01/2021 Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ...

HackerOne: Changing the 2FA secret key and backup codes without knowing the 2FA OTP

Summary: After the setup of 2FA, disabling or editing it should require the 2FA OTP. But it can be bypassed. Steps To Reproduce: 1 Sign in to a new HackerOne account. 2 Setup 2FA; and 3 Try to disable it without knowing the OTP. You can't, you need to know the Authentication Code or Backup Code...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

How to enable Facebook’s hardware key authentication for iOS and Android

Since 2017 desktop users have had the opportunity to use physical security keys to log in to their Facebook accounts. Now iOS and Android users have the same option too. Physical security keys are a more secure option for two-factor authentication 2FA than SMS which is vulnerable to SIM swap...

Security update for froxlor (moderate)

openSUSE Security Update: Security update for froxlor Announcement ID: openSUSE-SU-2021:0450-1 Rating: moderate References: 1025193 1082318 846355 958100 Cross-References: CVE-2016-5100 CVSS scores: CVE-2016-5100 NVD : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE...

Security update for froxlor (moderate)

openSUSE Security Update: Security update for froxlor Announcement ID: openSUSE-SU-2021:0415-1 Rating: moderate References: 1025193 1082318 846355 958100 Cross-References: CVE-2016-5100 CVSS scores: CVE-2016-5100 NVD : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE...

Joomla 1.6.x < 3.9.25 Multiple Vulnerabilities (5834-joomla-3-9-25)

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.6.x prior to 3.9.25. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of...

Is MFA a Security Illusion?

A recent Akamai Security blog post, Massive Campaign Targeting UK Banks Bypassing 2FA, written by my colleague Or Katz, is a great insight into how attackers used very simple techniques to bypass two-factor 2FA authentication security to obtain access to U.K. consumers' bank accounts. The attack...