CVE-2024-47768

Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system where there does not appear to be a check to make sure the user has been sent the recovery email and entered the correct code. If the attacke...

CVE-2024-47768

CVE-2024-47768 affects Lif Authentication Server (Lif). The vulnerability lies in the account recovery flow where there is no check to verify that the user has received the recovery email or entered the correct code. An attacker who knows the target’s email can supply the email and trigger a pass...

CVE-2024-47768 Lif Authentication Server Has No Auth Check When Updating Password In Account Recovery

Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system where there does not appear to be a check to make sure the user has been sent the recovery email and entered the correct code. If the attacke...

CVE-2024-47768 Lif Authentication Server Has No Auth Check When Updating Password In Account Recovery

Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system where there does not appear to be a check to make sure the user has been sent the recovery email and entered the correct code. If the attacke...

CVE-2024-47768 Lif Authentication Server Has No Auth Check When Updating Password In Account Recovery

Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system where there does not appear to be a check to make sure the user has been sent the recovery email and entered the correct code. If the attacke...

PT-2024-32806 · Unknown · Lif Authentication Server

Name of the Vulnerable Software and Affected Versions: Lif Authentication Server versions prior to 1.7.3 Description: The issue is related to the account recovery system of the Lif Authentication Server, where there is no check to ensure the user has received the recovery email and entered the...

HackerOne: Bypassing Two-Factor Authentication via Account Deactivation and Password Reset

Vulnerability description not provided...

TikTok: Account Takeover via Authentication Bypass in TikTok Account Recovery

An improper authentication mechanism in TikTok's account recovery process was identified. The vulnerability was reported and has been completely fixed. There was no evidence of exploitation...

MFA bombing taken to the next level

Simply put, MFA bombing also known as “push bombing” or “MFA fatigue” is a brute force attack on your patience. Cybercriminals use MFA bombing to break into accounts that are protected by multi-factor authentication MFA. MFA normally requires a user to enter a six-digit code sent by SMS, or...

Gessler GmbH WEB-MASTER Authorization Issue Vulnerability

Gessler GmbH WEB-MASTER is an emergency lighting management system from Gessler GmbH, Germany. A security vulnerability exists in Gessler GmbH WEB-MASTER version 7.9, which stems from the use of weakly hard-coded credentials to recover accounts, and which could be exploited by an attacker to take...

Design/Logic Flaw

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the getpfp and getbanner routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is...

Mozilla: Exposure of account recovery hint by querying by user email

The account recovery hint was exposed by querying the API with a user email. This allowed obtaining the hint and could enable phishing attacks...

Mozilla: Response Manipulation to enable Account recovery key with out current password

Vulnerability description not provided...

The Security Pros and Cons of Using Email Aliases

One way to tame your email inbox is to get in the habit of using unique email aliases when signing up for new accounts online. Adding a "+" character after the username portion of your email address -- followed by a notation specific to the site youre signing up at -- lets you create an infinite...

Facebook phishers threaten users with Page Recovery Help Support

We’ve seen multiple hijacked profiles on Facebook recently claiming to be account recovery services. These bogus account recovery services arent here to help. Theyre actually just trying to scare users into falling for phishing attempts. The people behind these scams target Facebook pages belongi...

CVE-2021-36760

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...

Open redirect

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...

CVE-2021-36760

WSO2 Identity Server 5.7.0 contains a DOM-Based XSS in accountrecoveryendpoint/recoverpassword.do that manipulates the callback parameter in the URL before the callback is invoked. This can lead to execution of injected JavaScript after the username/password reset flow completes. The same endpoin...

CVE-2021-36760

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...

MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed

The accounts of at least 6,000 Coinbase customers were robbed of funds after attackers bypassed the cryptocurrency exchange’s multi-factor authentication MFA. According to a notification letter PDF – seen and posted by BleepingComputer, which first reported the story – that Coinbase sent to...