BIT-GITLAB-2020-13304

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

BIT-GITLAB-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

BIT-GITLAB-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

BIT-GITLAB-2022-1963

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, ...

BIT-REDMINE-2021-37156

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated...

BIT-PHPMYADMIN-2022-23807

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances...

How to Turn Off Facebook’s Two-Factor Authentication Change

With Meta’s updated 2FA process, the company now automatically trusts devices you often use...

CVE-2023-25681

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID...

PT-2024-12068 · Ibm · Ibm Spectrum Virtualize

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Virtualize version 8.5 Description: The issue allows LDAP users configured to require multifactor authentication to authenticate to the CIM interface using only a username and password. This does not affect local users with MFA...

CVE-2023-25681: Use of Single-factor Authentication

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID...

PT-2024-2024 · Ibm · Ibm Qradar Suite +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Products versions 1.10.12.0 through 1.10.18.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue is related to weak password requirements in IBM QRadar Suite and IBM Cloud Pak for Security...

New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users

A novel phishing kit has been observed impersonating the login pages of well-known cryptocurrency services as part of an attack cluster codenamed CryptoChameleon that's designed to primarily target mobile devices. "This kit enables attackers to build carbon copies of single sign-on SSO pages, the...

CMS Security Vulnerability

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! CMS that stems from the MFA management feature failing to properly terminate an existing user session when the user's MFA method has been modified...

Identity theft is number one threat for consumers, says report

The German Federal Office for Information Security BSI has published a report on The State of IT Security in Germany in 2023, and the number one threat for consumers is… identity theft. The thing is, you can protect your devices and your online privacy as much as possible, but what happens when...

SonicWALL SMA100 Authorization Issues Vulnerability

The SonicWALL SMA100 is a security access gateway device from SonicWALL, Inc. An authorization issue vulnerability exists in SonicWALL SMA100 10.2.1.10-62SV and prior versions, which stems from the presence of an access control error vulnerability. An attacker could exploit the vulnerability to...

PT-2024-19387 · Unknown · Sma100 Ssl-Vpn

Name of the Vulnerable Software and Affected Versions: SMA100 SSL-VPN virtual office portal affected versions not specified Description: An improper access control issue has been identified in the SMA100 SSL-VPN virtual office portal. This issue could potentially enable a remote authenticated...

IBM PowerSC Authentication Error Vulnerability

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC has an Authentication Error Vulnerability vulnerability that stems from the use of single-factor authentication, which can be exploited by an attacker to cause a risk ...

PT-2024-1799

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions 23.9.7 and prior Description The vulnerability is an authentication bypass using an alternate path or channel, which may allow an attacker direct access to confidential information or critical systems. This...

Liferay Portal defaults to a low work factor for the default password hashing algorithm

The default password hashing algorithm PBKDF2-HMAC-SHA1 in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers...

CVE-2024-25607

The default password hashing algorithm PBKDF2-HMAC-SHA1 in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers...