Information disclosure

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-29381

The CVE-2023-29381 entry concerns Zimbra Collaboration (ZCS) versions 8.8.15 and 9.0, where a remote attacker can escalate privileges and disclose sensitive information via the password and 2FA parameters. Multiple connected sources (Red Hat, PT-Security, and related CVE aggregates) confirm the a...

CVE-2023-29381

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-29381: Incorrect Authorization

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-29381

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-36816

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

CVE-2023-36816

The CVE concerns the 2FAuth web application, where an XSS vulnerability exists in the account/service field. According to the provided records, the issue was demonstrated in a docker-compose test environment and has been patched as of version 4.0.3. The root cause is an input handling flaw that a...

CVE-2023-36816 Cross-Site Scripting (XSS) at Account creation in 2FAuth

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

CVE-2023-36816

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

PT-2023-25707

Name of the Vulnerable Software and Affected Versions 2FA versions prior to 4.0.3 Description The issue is related to a Cross Site Scripting XSS injection vulnerability in the 2FA Web application, which manages Two-Factor Authentication accounts and generates security codes. The XSS injection can...

CVE-2023-36816: Improper Neutralization of Input During Web Page Generation

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

Brute Force Attack

froxlor/froxlor is vulnerable to Brute Force Attacks. The vulnerability exists because it does not limit 2FA attempts, which allows an attacker to brute force the user credentials and perform unauthorized actions...

Over 100,000 Stolen ChatGPT Account Credentials Sold on Dark Web Marketplaces

Over 101,100 compromised OpenAI ChatGPT account credentials have found their way on illicit dark web marketplaces between June 2022 and May 2023, with India alone accounting for 12,632 stolen credentials. The credentials were discovered within information stealer logs made available for sale on t...

Information stealer compromises legitimate sites to attack other sites

Security researchers at Akamai have published a blog about a new Magecart-alike web skimming campaign that uses compromised legitimate sites as command and control C2 servers. A web skimmer is a piece of malicious code embedded in web payment pages to steal personally identifiable information PII...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

Authentication flaw

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2023-34228

JetBrains TeamCity versions prior to 2023.05 are affected by an authentication issue where 2FA was not checked for certain sensitive account actions. This is confirmed across multiple sources (CVE-2023-34228, Red Hat, PT-2023-24753, Nessus, etc.). The root cause is missing authentication checks b...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2023-34228: Use of Single-factor Authentication

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2022-36249

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...