1306 matches found
CVE-2021-22515
NetIQ Advanced Authentication MFA can be bypassed, allowing single-factor authentication in versions prior to 6.3 SP4 Patch 1. The vulnerability affects the MFA flow and could enable unauthorized access when MFA is expected. Public advisories reference NetIQ’s release of updates in 6.3 SP4 Patch ...
CVE-2021-22515: Incorrect Authorization
Multi-Factor Authentication MFA functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1...
PT-2021-15118
Name of the Vulnerable Software and Affected Versions NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1 Description The issue allows the bypass of Multi-Factor Authentication MFA functionality, enabling the use of single factor authentication. Recommendations For versions prior to 6...
CVE-2021-30120
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user...
Your Employees Want Passwordless. Isn't It Time You Gave It to Them?
I hate passwords. There, I said it. I dread getting an email from Akamai IT telling me it will soon be time to update my password. I procrastinate until the last possible moment instead of immediately doing what is actually a trivial process. I suspect I'm not alone in my dislike for passwords. T...
What is Web API Security❓ — Methods of Protection
What is Web API Security❓ — Methods of Protection Before stressing what web API security is, it is important to first explain what APIs are. What are APIs? Fully known as Application Programming Interface , API is a software middle person that allows your applications to talk with one another. It...
New API Lets App Developers Authenticate Users via SIM Cards
Online account creation poses a challenge for engineers and system architects: if you put up too many barriers, you risk turning away genuine users. Make it too easy, and you risk fraud or fake accounts. The Problem with Identity Verification The traditional model of online identity –...
Authentication bypass in SilverStripe GraphQL
The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though. Basic-auth has been removed as a default...
GHSA-MG2G-8PWJ-R2J2 Authentication bypass in SilverStripe GraphQL
The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though. Basic-auth has been removed as a default...
CVE-2020-26136
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA multi-factor authentication when using basic authentication...
CVE-2020-26136
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA multi-factor authentication when using basic authentication...
Authentication flaw
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA multi-factor authentication when using basic authentication...
CVE-2020-26136
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA multi-factor authentication when using basic authentication...
CVE-2020-26136
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA multi-factor authentication when using basic authentication...
CVE-2020-26136
CVE-2020-26136 affects SilverStripe GraphQL prior to fixes in 4.6.0-rc1, where MFA is not honored when basic authentication is used. Several connected advisories corroborate an authentication bypass risk via the GraphQL module, with mitigation notes indicating that basic-auth has been removed by ...
CVE-2020-26136 GraphQL doesn't honour MFA when using basic auth
More info at https://www.silverstripe.org/download/security-releases/cve-2020-26136...
How to secure your hybrid work world with a Zero Trust approach
We are operating in the most complex cybersecurity landscape we’ve ever seen. Sophisticated and determined attackers are the norm. And we all are preparing for the next great disruption—hybrid work. Security has never been more important, and as I shared in another Security blog today, it’s clear...
CVE-2021-22515
Multi-Factor Authentication MFA functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1...
SaaS Attacks: Lessons from Real-Life Misconfiguration Exploits
It’s unfortunate but true: SaaS attacks continue to increase. You can’t get around it, COVID-19 accelerated the already exploding SaaS market and caused industries not planning on making a switch to embrace SaaS. With SaaS apps becoming the default system of record for organizations, it has left...
Hackers Exploit VPN to Deploy SUPERNOVA malware on SolarWinds Orion
The U.S. Cybersecurity and Infrastructure Security Agency CISA has disclosed details of a new advanced persistent threat APT that's leveraging the Supernova backdoor to compromise SolarWinds Orion installations after gaining access to the network through a connection to a Pulse Secure VPN device...