Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2020-2063)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Zivver: Two-factor authentication can be disabled when logged in without 2fa or password confirmation

When a user performed sensitive actions on an account, he/she didn't have to provide his/her password after some inactivity. This issue is now addressed and to perform actions related to account security, the user has to provide his/her password before continuing...

Activision Refutes Claims of 500K-Account Hack

After reports surfaced that 500,000 Activision accounts may have been hacked, impacting online Call of Duty CoD players, the gaming giant is disputing the claim. The alleged breach was first flagged by the oRemyy account on Twitter, and was quickly amplified by others, who claimed that accounts...

CVE-2020-3977

VMware Horizon DaaS 7.x and 8.x before 8.0.1 Update 1 contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit th...

CVE-2020-3977

VMware Horizon DaaS 7.x and 8.x before 8.0.1 Update 1 contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit th...

Authentication flaw

VMware Horizon DaaS 7.x and 8.x before 8.0.1 Update 1 contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit th...

CVE-2020-3977

CVE-2020-3977 affects VMware Horizon DaaS 7.x and 8.x prior to 8.0.1 Update 1. Root cause: broken authentication due to how first-factor authentication is handled, enabling potential bypass of two-factor authentication for an attacker with a legitimate Horizon DaaS account. Impact: partial integr...

CVE-2020-3977: Missing Authentication for Critical Function

VMware Horizon DaaS 7.x and 8.x before 8.0.1 Update 1 contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit th...

The ABCs of Digital Distancing

No person is an island — despite the recent public health mandates on social distancing that might make us feel as though we are. Yet, sometimes these seemingly arbitrary constraints can catalyze innovations and approaches to common challenges – and everyone wins. In a recent tweet from entertain...

Rethinking Defensive Strategy at the Edge, Part 3: Strategies for Protective Action

Our three-part blog series, Re-thinking Defensive Strategy at the Edge, has been focusing on outlining a new defensive edge strategy for today's enterprise. We began with a discussion of data and indicators. Most recently, our second post focused on using risk signals and correlating them for...

Google Android Twilio Authy 2-Factor Competitive Condition Issue Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A competitive condition issue vulnerability exists in Android Twilio Authy 2-Factor versions prior to 24.3.7. The vulnerability stems from improper handling of concurrent access when concurrent...

This One Time on a Pen Test: Outwitting the Vexing VPN

Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. Just...

GitLab Session Fixation Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A session fixation vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and 13.3.4. Th...

CVE-2020-13307

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

UBUNTU-CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

Authentication flaw

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

UBUNTU-CVE-2020-13307

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...