938 matches found
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
Authentication flaw
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45331
The CVE-2021-45331 issue affects Gitea prior to 1.5.0 and is an Authentication Bypass where a malicious user could abuse the TOTP-based 2FA workflow to gain privileges. Root cause is an authentication mechanism flaw that allows submitting a valid TOTP correctly more than once, enabling privilege ...
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
Microsoft: Slow MFA adoption presents “dangerous mismatch” in security
Multi-factor authentication MFA has been around for many years now, but few enterprises have fully embraced it. In fact, according to Microsofts inaugural "Cyber Signals" report, only 22 percent of all its Azure Active Directory AD enterprise clients have adopted two-factor authentication 2FA, a...
Actor’s verified Twitter profile hijacked to spam NFT giveaways
When we refer to hijacked verified profiles on Twitter, it’s most commonly some sort of Elon Musk themed scam. The hijackers compromise the account, switch the picture to Elon, and then start spamming cryptocurrency links. Alternatively, they may keep the account as it is and spam images claiming...
2FA App Loaded with Banking Trojan Infests 10K Victims via Google Play
After remaining available for more than two weeks, a malicious two-factor authentication 2FA application has been removed from Google Play — but not before it was downloaded more than 10,000 times. The app, which is fully functional as a 2FA authenticator, comes loaded with the Vultur stealer...
Slack: Email html Injection
This bug is Email html Injection present in name of workspace while creating Impact The input is unsanitized and vulnerable which led to html injection which may lead to phishing. when 2fa is applied it send mail with injected html...
phpMyAdmin 4.9.x < 4.9.8, 5.1.x < 5.1.2 2FA Bypass Vulnerability (PMASA-2022-1) - Linux
phpMyAdmin is prone to a two factor authentication bypass vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
phpMyAdmin 4.9.x < 4.9.8, 5.1.x < 5.1.2 2FA Bypass Vulnerability (PMASA-2022-1) - Windows
phpMyAdmin is prone to a two factor authentication bypass vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
What is API Abuse ❓ Prevention measures.
APIs are paramount for constructing a steadfast and constant communication bridge that empowers devices to pass-on desired information seamlessly. Hackers adopt many ways to exploit the APIs and corrupt the targeted device. This API exploitation is a potential threat to API security and needs...
Box 2FA Bypass Opens User Accounts to Attack
UPDATE A security hole in Box, the cloud-based file-sharing service, paved the way for busting its multifactor authentication MFA, researchers said – and it’s the second such MFA bypass they have discovered in the service so far. Clearly, the stakes are high – gaining access to a Box account coul...
What is API Abuse ❓ Prevention measures.
APIs are paramount for constructing a steadfast and constant communication bridge that empowers devices to pass-on desired information seamlessly. Hackers adopt many ways to exploit the APIs and corrupt the targeted device. This API exploitation is a potential threat to API security and needs...
FIFA 22 phishers tackle customer support with social engineering
Players of smash hit gaming title FIFA 22 have become the target of a wave of attacks focused on account compromise. Up to 50 “high profile” accounts were hijacked by what may have been the same group. FIFA games are, traditionally, a big draw for scammers and phishers. Many sports titles offer...
A week in security (January 3 – 9)
Last week on Malwarebytes Labs: Ransomware attacks Finalsite, renders 8,000 school sites unreachable for days Patchwork APT caught in its own web Sophisticated phishing scheme spent years robbing authors of their unpublished work Google and Facebook fined $240 million for making cookies hard to...
Cross-Site Request Forgery (CSRF) in polonel/trudesk
Description There is a CSRF vulnerability which would allow an attacker to restart the server by simply having a victim with the appropriate privileges visit an attacker's crafted webpage. The vulnerability exists when performing a GET request to the /api/v1/admin/restart endpoint There is also...
CVE-2021-43068
Fortinet FortiAuthenticator 6.4.0 contains an improper authentication weakness that could allow an attacker to bypass the second factor via the RADIUS login portal. Multiple sources (NVD, CNVD, CNNVD, PRION) describe this as an authentication bypass vulnerability affecting FortiAuthenticator, wit...
CVE-2021-43067
Fortinet FortiAuthenticator has a information disclosure vulnerability (CVE-2021-43067) affecting version 6.4.0 and older branches (6.3.2 and below, 6.2.1 and below, 6.1.2 and below, 6.0.7 to 6.0.1). The issue allows an attacker to duplicate a target LDAP user’s two‑factor authentication token vi...
