CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

CVE-2022-35248

A improper authentication vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login...

Hackers Using Fake CircleCI Notifications to Hack GitHub Accounts

GitHub has put out an advisory detailing what may be an ongoing phishing campaign targeting its users to steal credentials and two-factor authentication 2FA codes by impersonating the CircleCI DevOps platform. The Microsoft-owned code hosting service said it learned of the attack on September 16,...

EulerOS Virtualization 2.9.1 : selinux-policy (EulerOS-SA-2022-2366)

According to the versions of the selinux-policy packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the...

EulerOS Virtualization 2.9.0 : selinux-policy (EulerOS-SA-2022-2402)

According to the versions of the selinux-policy packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the...

Credit Card Fraud That Bypasses 2FA

Someone in the UK is stealing smartphones and credit cards from people who have stored them in gym lockers, and is using the two items in combination to commit fraud: Phones, of course, can be made inaccessible with the use of passwords and face or fingerprint unlocking. And bank cards can be...

Uber Says It's Investigating a Potential Breach of Its Computer Systems

Ride hailing giant Uber disclosed Thursday it's responding to a cybersecurity incident involving a breach of its network and that it's in touch with law enforcement authorities. The New York Times first reported the incident. The company pointed to its tweeted statement when asked for comment on...

Rocket.Chat: Bypassing 2FA with conventional session management - open.rocket.chat

The vulnerability allowed bypassing two-factor authentication in open.rocket.chat by exploiting the email confirmation flow. An attacker could sign up, enable two-factor authentication, change the email, and then use the email confirmation link to log in without providing the two-factor...

WordPress WP 2FA plugin <= 2.2.1 - Time-Based Side-Channel Attack vulnerability

Time-Based Side-Channel Attack vulnerability discovered by Calvin Alkan in WordPress WP 2FA plugin versions = 2.2.1. Solution Update the WordPress WP 2FA plugin to the latest available version at least 2.3.0...

WP 2FA < 2.3.0 - Time-Based Side-Channel Attack

The plugin uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared...

Attacker can turn off 2FA of the Admin

Description The attacker can turn off the 2FA of the admin by performing the CSRF attack Steps to reproduce Step 1: Login as admin on the demo product and navigate to https://demo.corebos.com/index.php?module=Utilities&action=integration&op=getconfig2fa&userlist=1 Step 2: Turn on the 2FA and clos...

FreeBSD : Gitlab -- multiple vulnerabilities (e6b994e2-2891-11ed-9be7-454b1dd82c64)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b994e2-2891-11ed-9be7-454b1dd82c64 advisory. - Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Conte...

Twilio data breach turns out to be more elaborate than suspected

Earlier this month, messaging service Twilio got compromised by a sophisticated social engineering attack. After deploying phishing attacks against company employees, hackers were able to access user data, but now it seems that the impact of the hack was more elaborate than originally assumed. In...

Twilio Breach Also Compromised Authy Two-Factor Accounts of Some Users

Twilio, which earlier this month became a sophisticated phishing attack, disclosed last week that the threat actors also managed to gain access to the accounts of 93 individual users of its Authy two-factor authentication 2FA service. The communication tools company said the unauthorized access...

GHSA-8WJ3-CPMR-8WHP Cockpit Content Platform vulnerable to 2FA bypass

Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication 2FA bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the develop branch and is expected to be part...

Cockpit Content Platform vulnerable to 2FA bypass

Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication 2FA bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the develop branch and is expected to be part...

2FA Bypass in Cockpit Content Platform ≤ v2.2.1

Description 2FA secret is disclosed in JWT token after user logs into his account in Cockpit Content Platform ≤ v2.2.1 allowing attacker to bypass the 2FA code. Proof of Concept 1.Login with your admin account and enable 2FA in your account and logout. 2.Go to...

Slack flaw exposed users' hashed passwords

Slack, the workplace communication platform, has notified some of its users that their hashed passwords have been subject to exposure for the last five years. The company wasnt specific in its notice, but Wired said that the flaw was in one of its "low-friction features". The flaw exposed hashed...

Cloudflare Public Bug Bounty: Bypass two-factor authentication

Due to lack of validation, a malicious actor could brute force OTP 2fa and guess a correct number after multiple failures. The issue was fixed by the Engineering team by implementing restrictions on 2FA attempts...

CVE-2022-2303

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Passwo...