Vulnerability allowed bypassing 2FA in WHM & cPanel by bruteforcing

By Sudais Asif The vulnerability CVE-2020-27641 allowed malicious actors to bypass two-factor authentication 2FA on the software using brute-force attacks. This is a post from HackRead.com Read the original post: Vulnerability allowed bypassing 2FA in WHM & cPanel by bruteforcing...

CVE-2020-29136

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

Design/Logic Flaw

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

CVE-2020-29136

CVE-2020-29136 affects cPanel versions prior to 90.0.17, where an authentication bypass allows 2FA to be defeated via brute-force (SEC-575). Root cause: improper enforcement of multi-factor authentication during brute-force attempts. Impact: unauthorized access by bypassing 2FA; exploitation stat...

CVE-2020-29136

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

2-Factor Authentication Bypass Flaw Reported in cPanel and WHM Software

cPanel, a provider of popular administrative tools to manage web hosting, has patched a security vulnerability that could have allowed remote attackers with access to valid credentials to bypass two-factor authentication 2FA protection on an account. The issue, tracked as "SEC-575" and discovered...

CVE-2020-8236

Nextcloud Server 19.0.1 contains an improper authentication issue where a misconfiguration causes a passwordless WebAuthn PIN to be treated as two-factor authentication, but the PIN is not actually verified. This vulnerability could lead to users believing they have 2FA protection when the system...

Showmax: WordPress admin is accessible without HTTP authentication

The wordpress instance stories.showmax.com is a complementary system of the Showmax platform. We enforce 2FA for all user accounts that have access to the administration and that's why we decided not to require Basic Auth and/or IP whitelisting for it...

'Copyright Violation' Notices Lead to Facebook 2FA Bypass

Scammers have hatched a new way to attempt to bypass two-factor authentication 2FA protections on Facebook. Cybercriminals are sending bogus copyright-violation notices with the threat of taking pages down unless the user attempts to appeal. The first step in the “appeal?” The victim is asked to...

Researcher: I Hacked Trump’s Twitter by Guessing Password

Dutch ethical hacker Victor Gevers claims it only took five attempts to guess the password to President Donald Trump’s Twitter account — “maga2020!”. That’s all he needed to hijack the @realdonaldtrump handle, according a report from Dutch newspaper de Volksrant, because it lacked even the most...

On Risk-Based Authentication

Interesting usability study: "More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication": Abstract: Risk-based Authentication RBA is an adaptive security measure to strengthen password-based authentication. RBA monitors additional features during...

Fortinet FortiOS < 6.0.10 / 6.2.x < 6.2.4 / 6.4.x < 6.4.1 Improper Authentication (FG-IR-19-283)

The remote host is running a version of FortiOS prior to 6.0.10, 6.2.x prior to 6.2.4, or 6.4.x prior to 6.4.1. It is, therefore, affected by an improper authentication vulnerability due to an issue with the 'username-case-sensitivity' CLI attribute for the SSL VPN. An unauthenticated, remote...

Rocket.Chat: Improper Access Control - Generic

Vulnerability description not provided...

Alien Android Banking Trojan Sidesteps 2FA

A newly uncovered banking trojan called Alien is invading Android devices worldwide, using an advanced ability to bypass two-factor authentication 2FA security measures to steal victim credentials. Once it has infected a device, the RAT aims to steal passwords from at least 226 mobile application...

Android Malware Bypasses 2FA And Targets Telegram, Gmail Passwords

Researchers have uncovered a threat group launching surveillance campaigns that target victims’ personal device data, browser credentials and Telegram messaging application files. One notable tool in the group’s arsenal is an Android malware that collects all two-factor authentication 2FA securit...

Researchers Uncover 6-Year Cyber Espionage Campaign Targeting Iranian Dissidents

Capping off a busy week of charges and sanctions against Iranian hackers, a new research offers insight into what's a six-year-long ongoing surveillance campaign targeting Iranian expats and dissidents with an intention to pilfer sensitive information. The threat actor, suspected to be of Iranian...

Authentication flaw

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

CVE-2020-13307

CVE-2020-13307 affects GitLab versions before 13.1.10, 13.2.8, and 13.3.4. The vulnerability stems from GitLab not revoking current user sessions when two-factor authentication (2FA) is activated, allowing a malicious user to maintain access after 2FA enrollment. Reported across multiple feeds, t...

CVE-2020-13297

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint...

CVE-2020-13297

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint...