CVE-2022-0992 SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending...

CVE-2022-0992

The CVE-2022-0992 entry concerns the WordPress SiteGround Security plugin (versions up to 1.2.5). The vulnerability is an authentication bypass caused by missing identity verification during the initial 2FA setup, allowing unauthenticated users to configure 2FA for pending accounts and subsequent...

TikTok reset account password Exploit

Exploit can reset password and get full control any TikTok account. You can change target mobile phone without any problems, because exploit use bypass 2fa vulnerability...

Cloudflare Public Bug Bounty: Signup with any Email and Enable 2-FA without verifying Email

It was possible to enable Two-factor authentication feature for an unverified Cloudflare account . As a consequence, a legitimate owner of the e-mail address, which was used to create the unverified account, is unable to log in or reset password to the Cloudflare account. The issue was fixed by t...

WP 2FA < 2.2.0 - Arbitrary 2FA Disabling via IDOR

The plugin does not properly check for authorisation when disabling 2FA, allowing users to disable the protection of other users via an IDOR attack...

WordPress SiteGround Security 1.2.5 Authentication Bypass

Description: Authentication Bypass via 2-Factor Authentication Setup Affected Plugin: SiteGround Security Plugin Slug: sg-security Plugin Developer: SiteGround Affected Versions: = 1.2.5 CVE ID: CVE-2022-0992 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

SiteGround Security < 1.2.6 - Authorization Weakness to Authentication Bypass via 2-FA Back-up Codes

The method in which 2FA back-up code authentication is handled by the plugin makes it possible for attackers to log in if they are able to brute force a back-up code for a user or compromise it via other means such as SQL Injection...

SiteGround Security < 1.2.6 - Authentication Bypass via 2-FA Authentication Setup

The 2FA functionality of the plugin is insecurely implemented which could allow unauthenticated attackers to gain access to privileged accounts...

The Digital Citizen’s Guide to Navigating Cyber Conflict

As security professionals, we are currently being bombarded with warnings and alerts of a heightened threat level due to the possibility that Russia will start to more aggressively leverage cyberattacks as part of their offensive. If you are feeling the pressure of getting everything done, check...

Fortinet FortiToken Mobile Access Control Error Vulnerability

Fortinet FortiToken Mobile is an Oath-compliant, event-based and time-based one-time password Otp generator application from Fortinet U.S.A. An access control error vulnerability exists in Fortinet FortiToken Mobile versions 5.1.0 and below, which stems from a network system or the product does n...

TeaBot Trojan Haunts Google Play Store, Again

The TeaBot banking trojan – also known as “Anatsa” – has been spotted on the Google Play store, researchers from Cleafy have discovered. The malware – designed to intercept SMS messages and login credentials from unwitting users – affected users of “more than 400 banking and financial apps,...

CVE-2021-44166

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...

Improper access control

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...

CVE-2021-44166

Summary: CVE-2021-44166 affects Fortinet FortiToken Mobile for Android (external push notification, versions ≤ 5.1.0). The root cause is an improper access control (CWE-284) that could allow a remote attacker who already has a user’s password to access the protected system during the 2FA flow, ev...

CVE-2021-44166

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...

FortiToken Mobile (Android) - Deny request approved from External push notification

An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user...

Basecamp: Improper Authentication via previous backup code login

HI Basecamp, I would like to report Improper Authentication in basecamp. Attacker is able to login at victim account once victim update his password. attacker knows with victims email █████████ password uhn123HH victim updates his password uhn123HHjcc Step To Reproduce ==Attacker== - Step1 attack...

Twitter cans 2FA service provider over surveillance claims

Twitter is transitioning away from from its two-factor authentication 2FA provider, Mitto AG, a Swiss communications company. The social media giant broke the news to US Senator Ron Wyden of Oregon. It is noted that Twitters decision to move away from Mitto AG came after allegations that its...

GHSA-HFMF-Q69J-6M5P Reuse of one time passwords allowed in Gitea

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

Reuse of one time passwords allowed in Gitea

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...