Joomla! 3.x < 3.9.25 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.25. It is, therefore, affected by multiple vulnerabilities. - Usage of the insecure rand function within the process of generating the 2FA secret. CVE-2021-23126 - Usage of an...

CVE-2021-23127

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

CVE-2021-23126

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

CVE-2021-23127

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

CVE-2021-23126

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

Design/Logic Flaw

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

Design/Logic Flaw

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

CVE-2021-23127 [20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

CVE-2021-23127

CVE-2021-23127 affects Joomla! 3.2.0 through 3.9.24, where the 2FA secret generation uses an insufficient length (10 bytes instead of 20 bytes per RFC 4226). This vulnerability could impact authentication-related hashes/secrets. The connected docs indicate the issue lies in inadequate randomness/...

CVE-2021-23126

CVE-2021-23126 applies to Joomla! core in versions 3.2.0 through 3.9.24, where the 2FA secret is generated using the insecure rand() function, introducing predictable randomness in the 2FA secret generation. This vulnerability is tied to insecure randomness in the 2FA secret generation process. M...

CVE-2021-23126 [20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

CVE-2021-26593

In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secret can be regenerated. NOTE...

Design/Logic Flaw

UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secre...

CVE-2021-26593

In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secret can be regenerated. NOTE...

Massive Campaign Targeting UK Banks Bypassing 2FA

On 14 July, 2020, Oliver Hough, a security researcher from Cyjax, published a report centered on a phishing campaign targeting banking customers in the United Kingdom, which evades two-factor authentication 2FA...

Gang arrested for SIM-swapping celebrities, stealing $100 million

The UKs National Crime Agency NCA—working alongside the US Secret Service, Homeland Security, the FBI, Europol, and the District Attorneys Office of Santa Clara California—spearheaded the arrest of eight British citizens in the UK and Scotland, aged between 18 to 26, for a string of SIM swapping...

10 SIM Swappers Arrested for Stealing $100M in Crypto from Celebrities

Ten people belonging to a criminal network have been arrested in connection with a series of SIM-swapping attacks that resulted in the theft of more than $100 million by hijacking the mobile phone accounts of high-profile individuals in the U.S. The Europol-coordinated year-long investigation was...

CVE-2021-25759

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...

Design/Logic Flaw

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...

CVE-2021-25759

CVE-2021-25759 affects JetBrains Hub prior to 2020.1.12629, where an authenticated user can delete 2FA settings of any other user. This is documented across multiple sources (NVD/Red Hat/CNVD mirrors and the JetBrains Security Bulletin Q4 2020). The JetBrains bulletin states the issue was resolve...