Design/Logic Flaw

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-65

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

PYSEC-2019-135

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

GHSA-89PX-WW3J-G2MM 2FA bypass in Wagtail through new device path

2FA bypass through new device path Impact If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. Patches This problem has been patched in version 1.3.0...

2FA bypass in Wagtail through new device path

2FA bypass through new device path Impact If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. Patches This problem has been patched in version 1.3.0...

CVE-2019-16766 2FA bypass in Wagtail through new device path

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

CVE-2019-16766

Summary: CVE-2019-16766 affects the wagtail-2fa package prior to 1.3.0. If an attacker gains a user’s Wagtail credentials, they can bypass the two‑factor check by modifying the URL, then add a new device and gain full CMS access. The issue is resolved in version 1.3.0. Impact details (as describe...

Ginp Android trojan targets banking apps & threatens 2FA/SMS

By Waqas Dubbed Ginp; the trojan keeps coming back with new capabilities. Here's what the malware does to Android devices... This is a post from HackRead.com Read the original post: Ginp Android trojan targets banking apps & threatens 2FA/SMS...

Moneybird: Pending MFA logins aren't immediatly expired after a password change

Researcher found an issue with sessions not all being terminated when password is changed. The 2FA implementation was at fault in this scenario as the session was found to be active even after the password was changed and two-step verification was turned off...

Information Disclosure

pimcore/pimcore is vulnerable to information disclosure. The vulnerability exists through brute-force attacks for the 2FA token...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

Design/Logic Flaw

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

CVE-2019-18985 affects Pimcore prior to version 6.2.2, where there is no brute-force protection for the 2FA token. The vulnerability arises from missing rate-limiting on 2FA attempts, enabling offline-like or automated brute force toward 2FA tokens, potentially allowing account compromise. The CV...

ezXSS - An Easy Way For Penetration Testers And Bug Bounty Hunters To Test (Blind) Cross Site Scripting

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. Current features Some features ezXSS has Easy to use dashboard with statics, payloads, view/share/search reports and more Payload generator Instant email alert on payload Custom javascript...

Nextcloud: Bypass configured 2FA provider with another provider that can be set up at login

In Nextcloud 17 there is the possibility to set up 2FA providers at login. A missing check allows the following steps 1 Enforce 2FA for all users 2 As a user, configure a 2FA provider via settings or at login 3 Log out 4 Log in again password only 5 When prompted with the earlier set up provider,...

Why Keybase Doesn't Offer Two Factor Authentication

Keybase exists to keep things safe online. And it doesn't use 2FA to do it...

WiKID Systems 2FA Enterprise Server 4.2.0-b2032 SQL Injection / XSS / CSRF

WiKID Systems 2FA Enterprise Serverversion 4.2.0-b2032 and earlier was found to be vulnerable to multiple Cross-Site Scripting, SQLi, and CSRF issues. searchDevices.jsp is vulnerable to SQL injection through the uid and domain parameters. The application uses Postgres which supports Stacked...

CVE-2019-17120

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/admusrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after...