1412 matches found
PT-2019-14955
Name of the Vulnerable Software and Affected Versions WiKID 2FA Enterprise Server versions through 4.2.0-b2053 Description A SQL injection issue allows an authenticated user to execute arbitrary SQL commands via the key parameter in the processPref.jsp file. Recommendations For versions through...
PT-2019-14952
Name of the Vulnerable Software and Affected Versions WiKID 2FA Enterprise Server versions through 4.2.0-b2047 Description A stored and reflected cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the "/WiKIDAdmin/userPreregistration.jsp" API endpoint. T...
CVE-2019-17119: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter...
CVE-2019-17118: Cross-Site Request Forgery (CSRF)
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...
CVE-2019-16917: Improper Neutralization of Special Elements used in an SQL Command
WiKID Enterprise 2FA two factor authentication Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function...
CVE-2019-17120: Improper Neutralization of Input During Web Page Generation
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/admusrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after...
CVE-2019-17117: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter...
CVE-2019-17116: Improper Neutralization of Input During Web Page Generation
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting occurs immediately...
CVE-2019-17115: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The renderedmessage column is retrieved and displayed, unsanitized, on Logs.jsp. A remote...
CVE-2019-17114: Improper Neutralization of Input During Web Page Generation
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...
PT-2019-14953
Name of the Vulnerable Software and Affected Versions WiKID 2FA Enterprise Server versions through 4.2.0-b2047 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple API endpoints, including "/wikid/servlet/com.wikidsystems.server.GetDomainHash" with the...
PT-2019-14867
Name of the Vulnerable Software and Affected Versions WiKID Enterprise 2FA Enterprise Server versions through 4.2.0-b2047 Description The issue allows for SQL injection through the "searchDevices.jsp" endpoint, utilizing the uid and domain parameters unsanitized in a SQL query constructed in the...
Phishing Tool Analysis: Modlishka
Additional research and support provided by Danny Wasserman. Overview One of the goals of phishing sites is to lure individuals into providing sensitive data, such as personally identifiable information, banking and credit card details, and passwords, through the use of email, SMS, social media,...
Razer: 2FA doesn't work in "https://insider.razer.com"
Hello, I found 2FA bypass vulnerability in https://insider.razer.com and I found this feature not at all working after enabled 2FA. Please follow the below steps to reproduce the issue Steps to reproduce 1. Login to https://insider.razer.com with your credentials. 2. Next, go to Two-Step...
Omise: Signup with any email and enable 2FA without verifying email
Description : When i signup, i can enable 2FA without verification my email. Attack Scenario : 1. The Attacker signup with the victim email. 2. Go to Two factor authetication and enable 2FA Impact when the victim want to register in this site, they can't, because they email claims by attacker. an...
Shopify: The authentication code when activating 2FA can be used again to log in
Hi team, Summary: ====================== I noticed that when activating 2FA by sms, you can also use that 2FA activation code, to use as an authentication code when logging in. Steps: ========================= 1, Go to: https://accounts.shopify.com/accounts/36430415/security and log in 2, Activat...
sssd security, bug fix, and enhancement update
1.16.4-21 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization - Rebuild japanese gmo file explicitly 1.16.4-20 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization 1.16.4-19 - Resolves: rhbz1707959 - sssd does not properly check GSS-SPNEGO 1.16.4-18 - Resolves: rhbz1710286 - The...
Mail.ru: Disable 2FA via CSRF (Leads to 2FA Bypass)
CSRF vulnerability in pandao.ru allowed to disable 2FA. pandao.ru belongs to extended scope...
Grammarly: Previously created sessions continue being valid after MFA activation
Hi team, I found one issue related to your 2FA system on https://account.grammarly.com/security POC 1 access the same account on https://account.grammarly.com in two devices 2 on device 'A' go to https://account.grammarly.com/security complete all steps to activate the 2FA system Now the 2FA is...
