GitLab 11.0 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39874)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. CVE-2021-39874 Note that Nessus has not tested for this issue but has instead...

CVE-2022-44589

CVE-2022-44589 affects miniOrange's Google Authenticator – WordPress Two Factor Authentication plugin, with exposure of sensitive information up to version 5.6.1. Affected versions are listed as n/a through 5.6.1. Multiple sources recommend upgrading to a version later than 5.6.1 (e.g., 5.6.2+). ...

CVE-2023-49949

Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes...

Design/Logic Flaw

Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes...

CVE-2023-49949

Passwork before 6.2.0 contains a vulnerability in the authorization procedure that allows a remote authenticated user to bypass two‑fact‑authentication (2FA) by brute‑forcing a one‑time six‑digit code. Affected software is Passwork prior to 6.2.0 . The issue arises from weaknesses in the 2FA work...

CVE-2023-49949

Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes...

Comcast’s Xfinity breached by Citrix Bleed; 36 million customer’s data accessed

In a notice for its customers, Xfinity acknowledges it recently fell victim to a data security incident. Xfinity is Comcasts brand for TV, internet, and home phone services, sometimes referred to as Comcast Cable Communications. During the data breach the attackers were able to access 35.8 millio...

CVE-2023-6272

The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits...

Design/Logic Flaw

The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits...

CVE-2023-6272 Theme My Login 2FA < 1.2 - Lack of Rate Limiting

The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits...

CVE-2023-6272

CVE-2023-6272 affects Theme My Login 2FA WordPress plugin, versions prior to 1.2. The root cause is lack of rate limiting on 2FA validation attempts, enabling brute-force of 6-digit codes. Impact: potential unauthorized access to 2FA-protected accounts. Remediation: upgrade to 1.2 or later (patch...

Authentication Bypass

gitea is vulnerable to Authentication Bypass. The vulnerability is caused when docker login uses basic authentication, which allows an attacker to bypass 2FA authentication...

CVE-2023-49947

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication...

Authentication flaw

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication...

CVE-2023-49947

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication...

Incorrect Authorization

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication...

CVE-2023-49947

CVE-2023-49947 concerns Forgejo prior to 1.20.5-1, where using docker login with Basic Authentication enables a 2FA bypass. The core issue is a bypass of two-factor authentication when Basic Auth is used during Docker login. The CVE is reflected in multiple sources (NVD, Red Hat advisories, CVE l...

WordPress Theme My Login 2FA Plugin < 1.2 is vulnerable to Bypass Vulnerability

Software Theme My Login 2FA Type Plugin Vulnerable versions 1.2 Fixed in 1.2 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2023-6272 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 8ec60bf22c2e Credits Joost Grunwald Required privilege...

Kubernetes Secrets of Fortune 500 Companies Exposed in Public Repositories

Cybersecurity researchers are warning of publicly exposed Kubernetes configuration secrets that could put organizations at risk of supply chain attacks. "These encoded Kubernetes configuration secrets were uploaded to public repositories," Aqua security researchers Yakir Kadkoda and Assaf Morag...

Theme My Login 2FA < 1.2 - Lack of Rate Limiting

Description The plugin does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits. https://packetstormsecurity.com/2309-exploits/wpmylogin-bruteforce.txt...