CVE-2019-1020002

Pterodactyl before 0.7.14 with 2FA allows credential sniffing...

Design/Logic Flaw

Pterodactyl before 0.7.14 with 2FA allows credential sniffing...

CVE-2019-1020002

Pterodactyl before 0.7.14 with 2FA allows credential sniffing...

CVE-2019-1020002

CVE-2019-1020002 affects the Pterodactyl Panel before 0.7.14, where a logic error causes credentials/sniffing of 2FA credentials by delaying password verification until after 2FA input. Reported as enabling an attacker to infer account existence under certain login flows (0.7.13 and earlier). The...

PT-2019-11618

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 0.7.14 Description: The issue allows malicious users to determine the existence of an account by entering random credentials into the login fields, even when 2FA protections are enabled. This is due to a logical...

CVE-2019-1020002: Observable Discrepancy

Pterodactyl before 0.7.14 with 2FA allows credential sniffing...

A week in security (July 15 – 21)

Last week on Malwarebytes Labs, we took an extensive look at Sodinokibi, one of the new ransomware strains found in the wild that many believe picked up where GandCrab left off. We also profiled Extenbro, a Trojan that protects adware; reported on the UK's new Facebook reporting tool, homed in on...

Moneybird: Enable 2FA without verifying the email

Description : I able to add 2FA to my account without verifying my email Attack scenario : 1. Attacker sign up with victim email Email verification will be sent to victim email. 2. Attacker able to login without verifying email. 3. Attacker add 2FA. Impact the victim can't register an account wit...

Researcher Bypasses Instagram 2FA to Hack Any Account

A researcher earned a $30,000 bug bounty from Facebook after discovering a weakness in the Instagram mobile recovery process that would allow account takeover for any user, via mass brute-force campaigns. Independent researcher Laxman Muthiyah took a look at Instagram’s mobile recovery flow, whic...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Cross site request forgery (csrf)

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

CVE-2019-12363

CVE-2019-12363 describes a CSRF vulnerability in the JN-Jones MyBB-2FA plugin for MyBB (up to 2014-11-05). An attacker can forge requests to an installed mybb2fa plugin to change its state via usercp.php?action=mybb2fa&do=deactivate (or ...&do=activate). This deactivates two-factor authentication...

PT-2019-12765

Name of the Vulnerable Software and Affected Versions JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB Description A CSRF issue allows an attacker to forge a request to control the state of the mybb2fa plugin via "usercp.php?action=mybb2fa&do=deactivate" or...

CVE-2019-12363: Cross-Site Request Forgery (CSRF)

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Microsoft Adds 2FA-Protected "Personal Vault" Within OneDrive Cloud Storage

Microsoft has introduced a new password-protected folder within its OneDrive online file storage service that will allow you to keep your sensitive and important files protected and secured with an extra layer of authentication. Dubbed Personal Vault, the new OneDrive folder can only be accessed...

A week in security (June 17 – 23)

Last week on the Malwarebytes Labs blog, we took a look at the growing pains of smart cities, took a deep dive into AI, jammed along to Radiohead, and looked at the lessons learned from Chernobyl in relation to critical infrastructure. We also explored a new Steam phish attack, and pulled apart a...

New Android malware bypass 2FA & steal one-time passwords

By Uzair Amir These apps were designed to pass as BtcTurk, a Turkish cryptocurrency exchange. Researcher Lukas Stefanko at the Slovakian security firm ESET has discovered Android malware in new apps that can bypass the SMS-based two-factor authentication 2FA without using SMS permissions. The...

Malicious Package

Overview All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you...

Malicious Package

Overview All versions of shrugging-logging contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. I...

PT-2019-2826

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 10 1803 and later Microsoft Windows Server versions 2019 and later Description The issue is related to errors in handling RDP sessions based on NLA, allowing an attacker to bypass two-factor authentication mechanisms...