1561 matches found
CVE-2023-6520
CVE-2023-6520 covers the WP 2FA – Two-factor authentication for WordPress plugin. The vulnerability exists in versions
CVE-2023-6520 WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the sendbackupcodesemail function. This makes it possible for unauthenticated...
CVE-2023-6506: Authorization Bypass Through User-Controlled Key
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...
PT-2024-14983
Name of the Vulnerable Software and Affected Versions WP 2FA – Two-factor authentication for WordPress plugin versions up to, and including, 2.5.0 Description The issue is related to Insecure Direct Object Reference. It affects the send backup codes email function due to missing validation on a...
PT-2024-14989
Name of the Vulnerable Software and Affected Versions WP 2FA – Two-factor authentication for WordPress plugin versions up to, and including, 2.5.0 Description The issue is due to missing or incorrect nonce validation on the send backup codes email function, making it possible for unauthenticated...
CVE-2023-6520: Cross-Site Request Forgery (CSRF)
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the sendbackupcodesemail function. This makes it possible for unauthenticated...
SEC X account hacked to hawk crypto-scams
We have seen several high-profile accounts that were taken over on X formerly Twitter only to be used for cryptocurrency related promotional activities, like expressing the approval of exchange-traded funds ETFs. The latest victim in this line-up is the Securities and Exchange Commission SEC. The...
23andMe blames “negligent” breach victims, says it’s their own fault
In a surprising move, in a letter to legal representatives of victims of the recent 23andMe data breach, the company has laid the blame at the feet of victims themselves. 23andMe even goes as far as to claim that this wasn’t a data breach at 23andMe at all. The reasoning: “… unauthorized actors...
Mandiant's Twitter Account Restored After Six-Hour Crypto Scam Hack
American cybersecurity firm and Google Cloud subsidiary Mandiant had its X formerly Twitter account compromised for more than six hours by an unknown attacker to propagate a cryptocurrency scam. As of writing, the account has been restored on the social media platform. It's currently not clear ho...
WordPress WP 2FA Plugin <= 2.5.0 is vulnerable to Insecure Direct Object References (IDOR)
Software WP 2FA Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.6.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6506 Patch priority Low CVSS severity Low 4.3 Developer Melapress PSID 04c088b10b91 Credits Ulyses Saicha Required...
WordPress WP 2FA Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software WP 2FA Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.6.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6520 Patch priority Low CVSS severity Low 4.3 Developer Melapress PSID 95117a5d7a1e Credits Ulyses Saicha Required privilege...
WP 2FA < 2.6.0 - Arbitrary Email Sending via CSRF
Description The plugin has a flawed CSRF check when sending emails to registered users, which could allow attackers to make logged in admins perform such action via a CSRF attack...
GitLab 0.0 < 15.1.6 / 15.2 < 15.2.4 / 15.3 < 15.3.2 (CVE-2022-3031)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for ...
WP 2FA < 2.6.0 - Subscriber+ Arbitrary Email Sending
Description The plugin is vulnerable to Insecure Direct Object Reference via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site...
GitLab 11.0 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39874)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. CVE-2021-39874 Note that Nessus has not tested for this issue but has instead...
GitLab 14.1.1 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39890)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. CVE-2021-39890 Note that Nessus has not tested for this issue but has...
PT-2025-2944
Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue concerns a CSRF Cross-Site Request Forgery on 2FA Two-Factor Authentication registration. Recommendations At the moment, there is no information about a newer version that...
CVE-2022-44589
CVE-2022-44589 affects miniOrange's Google Authenticator – WordPress Two Factor Authentication plugin, with exposure of sensitive information up to version 5.6.1. Affected versions are listed as n/a through 5.6.1. Multiple sources recommend upgrading to a version later than 5.6.1 (e.g., 5.6.2+). ...
CVE-2022-44589: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor...
