58 matches found
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password aka OTP, which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing ...
GHSA-X489-JJWM-52G7 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password aka OTP, which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing ...
Code injection
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...
CVE-2015-7225
Concretely, CVE-2015-7225 affects devise-two-factor prior to v4.0.2, where an OTP can be reused for one immediately trailing time interval due to an incomplete fix. Multiple connected records (e.g., CVE-2021-43177 references) confirm the vulnerability pattern and the remediation: upgrade to devis...
CVE-2016-6238
The CVE-2016-6238 entry concerns Dropbox Lepton 1.0. The vulnerability is in the write_ujpg function (lepton/jpgcoder.cc) and allows remote attackers to cause a denial of service via an out-of-bounds read when processing a crafted JPEG file. This impact is described across multiple sources (NVD, ...
CVE-2015-6238
The CVE-2015-6238 entry concerns the Google Analyticator WordPress plugin. Vulnerable versions are prior to 6.4.9.6, where multiple XSS vectors exist through parameters on the google-analyticator page (ga_adsense, ga_admin_disable_DimentionIndex, ga_downloads_prefix, ga_downloads, ga_outbound_pre...
Google Analyticator 6.4.9.4 Cross Site Scripting
Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Google Analyticator Affected Software : Google Analyticator WordPress Plugin Affected Versions: 6.4.9.4 and possibly below Vendor Homepage : https://wordpress.org/plugins/google-analyticator/...
CVE-2014-6238
CVE-2014-6238 is a Cross-Site Scripting (XSS) vulnerability affecting the TYPO3 extension Akronymmanager (aka SB Folderdownload) version 0.5.0 and earlier. The connected TYPO3 security bulletin lists sb_akronymmanager as vulnerable with XSS via unspecified vectors, but does not provide exploit de...
CVE-2008-6238
The CVE-2008-6238 entry describes a Cross-site Scripting (XSS) vulnerability in OpenEdit Digital Asset Management (DAM) prior to version 5.2014. The flaw resides in archive/savedqueries/savequeryfinish.html where an attacker can inject arbitrary web script or HTML via the name parameter. The issu...
CVE-2007-6238
Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors, probably a different vulnerability than CVE-2007-6166. NOTE: this information is based upon a vague advisory by a vulnerability information sales organizati...
CVE-2007-6238
Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors, probably a different vulnerability than CVE-2007-6166. NOTE: this information is based upon a vague advisory by a vulnerability information sales organizati...
CVE-2007-6238
Technical details for CVE-2007-6238 are not publicly provided in the provided documents; the Initial Description is vague. Monitor for updates.
CVE-2006-6238
Technical details for CVE-2006-6238 are not provided in the supplied documents. Connected sources reference related Safari issues and other CVEs but do not specify affected versions, root cause, or fixes. Monitor for updates.