CVE-2016-10826

CVE-2016-10826 affects cPanel preceding 55.9999.141, where attackers can bypass two‑factor authentication via DNS clustering requests (SEC-93). The Red Hat/CNVD/NVD entries corroborate the vulnerability description and affected version. Remediation noted in public records is to upgrade to 55.9999...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

Authentication flaw

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10831

CVE-2016-10831 affects cPanel before 55.9999.141. The issue is an authentication flaw where possessing another account does not trigger a two-factor authentication check (SEC-101). The vulnerability is described across multiple sources as an authorization/authentication issue in these versions. I...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

The Unsexy Threat to Election Security

Much has been written about the need to further secure our elections, from ensuring the integrity of voting machines to combating fake news. But according to a report quietly issued by a California grand jury this week, more attention needs to be paid to securing social media and email accounts...

HPE IceWall SSO Agent Option and IceWall MFA Input Validation Error Vulnerability

HPE IceWall SSO and HPE IceWall MFA are both products of Hewlett Packard Enterprise HPE, U.S.A. HPE IceWall SSO is a single-sign-on program that provides authentication capabilities for users.HPE IceWall SSO Agent Option HPE IceWall SSO Agent Option is an agent-based option for HPE IceWall SSO.HP...

Slack Initiates Mass Password Reset

Popular workspace collaboration platform Slack is in the middle of asking tens of thousands of users to reset their passwords after a security breach. The move is actually in response to new information that has come to light regarding a 2015 compromise, when hackers infiltrated Slack’s networks ...

This Flaw Could Have Allowed Hackers to Hack Any Instagram Account Within 10 Minutes

Watch out! Facebook-owned photo-sharing service has recently patched a critical vulnerability that could have allowed hackers to compromise any Instagram account without requiring any interaction from the targeted users. Instagram is growing quickly—and with the most popular social media network ...

MyBB JN-Jones MyBB-2FA plugin cross-site request forgery vulnerability

MyBB MyBulletinBoard is the MyBB team developed a set of PHP and MySQL development of free and Web-based forum software. The software is easy to use , support for multiple languages , scalable and so on.JN-Jones MyBB-2FA plugin is used in which a two-factor authentication plugin . A cross-site...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Cross site request forgery (csrf)

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

CVE-2019-12363

CVE-2019-12363 describes a CSRF vulnerability in the JN-Jones MyBB-2FA plugin for MyBB (up to 2014-11-05). An attacker can forge requests to an installed mybb2fa plugin to change its state via usercp.php?action=mybb2fa&do=deactivate (or ...&do=activate). This deactivates two-factor authentication...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Vulnerability to bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...

Vulnerability to bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...

Microsoft to Require Multi-Factor Authentication for Cloud Solution Providers

It might be difficult to fathom how this isn't already mandatory, but Microsoft Corp. says it will soon force all Cloud Solution Providers CSPs that help companies manage their Office365 accounts to use multi-factor authentication. The move comes amid a noticeable uptick in phishing and malware...

KeyIdentity LinOTP Access Control Error Vulnerability

KeyIdentity LinOTP is the German company KeyIdentity is an open source two-factor authentication solution. The solution supports different authentication protocols, token types and user repositories. An access control error vulnerability exists in KeyIdentity LinOTP versions prior to 2.10.5.3. Th...

Microsoft Adds 2FA-Protected "Personal Vault" Within OneDrive Cloud Storage

Microsoft has introduced a new password-protected folder within its OneDrive online file storage service that will allow you to keep your sensitive and important files protected and secured with an extra layer of authentication. Dubbed Personal Vault , the new OneDrive folder can only be accessed...