Housemates. The new Red Team?

You have the VPN set up, you have 2FA, you have a good enforced password policy, firewalls are in place, you even managed to squeeze in some remote training to make employees more aware of potential phishing. You stop, breathe a sigh of relief, and then think… I've no idea who my employees live...

New nasty Android EventBot malware infects devices by evading 2FA

By Sudais Asif Another day, another Android malware but this one evades detection by bypassing 2FA. Here's how... This is a post from HackRead.com Read the original post: New nasty Android EventBot malware infects devices by evading 2FA...

WiKID 2FA Enterprise Server Cross-Site Scripting (CVE-2019-17116)

A cross-site scripting vulnerability exists in WiKID 2FA Enterprise Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

How Federal Employees Can Protect their Agencies During the Pandemic

It’s no secret that the way the world works has shifted since COVID-19 came on the scene. Operations are going remote and, for many government and federal agencies, this is new territory. This novelty is compounded by the fact that nation-state attacks are—and have been—on the rise for quite some...

TrickBot App Bypasses Non-SMS Banking 2FA

The TrickBot trojan has a new trick up its sleeve for bypassing a new kind of two-factor authentication 2FA security method used by banks – by fooling its victims into downloading a malicious Android app. The app, which researchers dubbed “TrickMo,” is still under active development. While TrickM...

Tips for Securing Remote Workers

As more and more employees are mandated to work from home, security and non-security professionals alike are left wondering what they can do to keep their data and systems safe. To help with this, we’ve compiled a list of some of the key things you can do to ensure your defenses are up—on or off...

CVE-2020-5240

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

CVE-2020-5240

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

Design/Logic Flaw

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

PYSEC-2020-219

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

CVE-2020-5240

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially...

CVE-2020-5240

CVE-2020-5240 affects wagtail-2fa prior to 1.4.1. Any CMS user can view and delete other users’ 2FA devices by accessing a specific path, bypassing permissions and potentially compromising accounts. The root issue is an authorization flaw that does not require special permissions to manipulate an...

2FA bypass through deleting devices in wagtail-2fa

Impact Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the...

GHSA-9GJV-6QQ6-V7QM 2FA bypass through deleting devices in wagtail-2fa

Impact Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the...

Helium: Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verify

Description: Hello, team! I found 2 vulnerabilities in your 2FA implementation: 1 There is a possibility to link 2FA to any other account if it wasn't set up before and user ID is known on the request /api/2fa. In order to do this, after performing a request for 2FA linking, substitute the ID to...

Loyalty Cards Targeted in Tesco Clubcard Attack

U.K. supermarket giant Tesco is warning on a credential-stuffing attack that potentially affects 600,000 members of its Clubcard loyalty program. It said that it detected cybercriminals trying out different name and password combos, gleaned from a database of stolen usernames and passwords for...

WiKID 2FA Enterprise Server SQL Injection (CVE-2019-16917; CVE-2019-17117; CVE-2019-17119)

An SQL injection vulnerability exists in WiKID 2FA Enterprise Server. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL commands against the database on the target server...

WiKID 2FA Enterprise Server Stored Cross-Site Scripting (CVE-2019-17115)

A stored cross-site scripting vulnerability exists in WiKID 2FA Enterprise Server. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary script code on the affected system...

Ring Mandates 2FA After Rash of Hacks

Connected doorbell-maker Ring is now requiring two-factor authentication 2FA for all users when they sign into their accounts. The new requirement comes after Ring faced a backlash in December following a rash of disturbing hacks and security issues tied to the smart doorbell. While Amazon-owned...

Shopify: Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Summary This report is based on the scenario that email confirmation has been bypassed already, like shown in 791775. What happened in 791775 was, I was too excited and didn't take a step...