CVE-2023-37919 Cal.com not expiring old sessions after enabling 2FA

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other devices stays logged ...

Debian: Security Advisory (DLA-3496-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3496-1] lemonldap-ng security update

Debian LTS Advisory DLA-3496-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin July 14, 2023 https://wiki.debian.org/LTS Package : lemonldap-ng Version : 2.0.2+ds-7+deb10u9 CVE ID : CVE-2023-28862 Issues were discovered in Lemonldap::NG, an OpenID-Connect, CAS and...

Debian dla-3496 : lemonldap-ng - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3496 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3496-1 [email protected] https://www.debian.org/lts/security/...

PT-2023-25880 · Pimcore · Pimcore Admin Classic Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Admin Classic Bundle versions prior to 1.0.3 Description: The issue allows for unauthenticated HTML injection or cross-site scripting XSS, affecting admins who have not set up two-factor authentication. This can cause the application ...

CVE-2023-29381

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

Information disclosure

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-29381

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-29381

The CVE-2023-29381 entry concerns Zimbra Collaboration (ZCS) versions 8.8.15 and 9.0, where a remote attacker can escalate privileges and disclose sensitive information via the password and 2FA parameters. Multiple connected sources (Red Hat, PT-Security, and related CVE aggregates) confirm the a...

CVE-2023-29381

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters...

CVE-2023-36816

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

CVE-2023-36816 Cross-Site Scripting (XSS) at Account creation in 2FAuth

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

CVE-2023-36816

The CVE concerns the 2FAuth web application, where an XSS vulnerability exists in the account/service field. According to the provided records, the issue was demonstrated in a docker-compose test environment and has been patched as of version 4.0.3. The root cause is an input handling flaw that a...

Brute Force Attack

froxlor/froxlor is vulnerable to Brute Force Attacks. The vulnerability exists because it does not limit 2FA attempts, which allows an attacker to brute force the user credentials and perform unauthorized actions...

Over 100,000 Stolen ChatGPT Account Credentials Sold on Dark Web Marketplaces

Over 101,100 compromised OpenAI ChatGPT account credentials have found their way on illicit dark web marketplaces between June 2022 and May 2023, with India alone accounting for 12,632 stolen credentials. The credentials were discovered within information stealer logs made available for sale on t...

Information stealer compromises legitimate sites to attack other sites

Security researchers at Akamai have published a blog about a new Magecart-alike web skimming campaign that uses compromised legitimate sites as command and control C2 servers. A web skimmer is a piece of malicious code embedded in web payment pages to steal personally identifiable information PII...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

Authentication flaw

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...

CVE-2023-34228

JetBrains TeamCity versions prior to 2023.05 are affected by an authentication issue where 2FA was not checked for certain sensitive account actions. This is confirmed across multiple sources (CVE-2023-34228, Red Hat, PT-2023-24753, Nessus, etc.). The root cause is missing authentication checks b...

CVE-2023-34228

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions...