894 matches found
CVE-2021-37597
CVE-2021-37597 affects WordPress WP Cerber plugin versions prior to 8.9.3, where MFA can be bypassed by manipulating the wordpress_logged_in_[hash] value. The issue is described in multiple sources as a 2FA bypass vulnerability with high impact. A fix is available in version 8.9.3 and later; upgr...
CVE-2021-37597
WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...
Check your passwords! Synology NAS devices under attack from StealthWorker
Synology PSIRT Product Security Incident Response Team has put out a warning that it has recently seen and received reports about an increase in brute-force attacks against Synology devices. PSIRT suspects the botnet commonly known as StealthWorker is responsible for this increase in activity...
org.apereo.cas:cas-server-support-gauth (>=6.2.0 <=6.2.3), org.apereo.cas:cas-server-support-gauth-core (>=6.2.0 <=6.2.3) +9 more potentially affected by CVE-2020-27178 via org.apereo.cas:cas-server-support-otp-mfa-core (>=6.2.0 <=6.2.3)
org.apereo.cas:cas-server-support-otp-mfa-core MAVEN version =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.3 Source cves: CVE-2020-27178 Source advisory: OSV:GHSA-Q39C-5VH5-VW2P...
org.apereo.cas:cas-server-support-gauth (>=6.0.0 <=6.1.7.1), org.apereo.cas:cas-server-support-gauth-core (>=6.0.0 <=6.1.7.1) +8 more potentially affected by CVE-2020-27178 via org.apereo.cas:cas-server-support-otp-mfa-core (>=6.0.0 <=6.1.7.1)
org.apereo.cas:cas-server-support-otp-mfa-core MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.0, =6.0.0, =6.0.0, =6.1.0, =6.1.7.1 Source cves: CVE-2020-27178 Source advisory: OSV:GHSA-Q39C-5VH5-VW2P...
Cutting the Red Tape: Lessons Learned from CyberThreats 2021
If I had a dollar for every time I heard the phrase "digital transformation," I would have a lot of dollars. I'm sure you would too. We'd have even more if we counted the term "Zero Trust." Maybe we should start counting them, now that I think about it! Speakers and authors often use these buzz...
Rockstar Games: Brute Force against VMware Horizon
In this report, the researcher discovered a VMWare Horizon admin remote access login portal that was publicly accessible and not sufficiently protected against credential stuffing/brute force attacks. No user accounts were breached; all employees are required to use MFA to login through such...
Anyone for Alphabet Soup? ZTNA, SWGs, MFA, and More: Lessons Learned from Fed Day CyberThreats 2021
Last week, we gathered a few of the most prominent leaders and experts from every corner of the federal space to talk about all things cybersecurity and digital transformation. Discussions ranged from the move toward Zero Trust Network Access ZTNA, and effectively managing identities and access...
Authentication flaw
Multi-Factor Authentication MFA functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1...
CVE-2021-22515 Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server
Multi-Factor Authentication MFA functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1...
CVE-2021-22515
NetIQ Advanced Authentication MFA can be bypassed, allowing single-factor authentication in versions prior to 6.3 SP4 Patch 1. The vulnerability affects the MFA flow and could enable unauthorized access when MFA is expected. Public advisories reference NetIQ’s release of updates in 6.3 SP4 Patch ...
CVE-2021-30120
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user...
Your Employees Want Passwordless. Isn't It Time You Gave It to Them?
I hate passwords. There, I said it. I dread getting an email from Akamai IT telling me it will soon be time to update my password. I procrastinate until the last possible moment instead of immediately doing what is actually a trivial process. I suspect I'm not alone in my dislike for passwords. T...
What is Web API Security❓ — Methods of Protection
What is Web API Security❓ — Methods of Protection Before stressing what web API security is, it is important to first explain what APIs are. What are APIs? Fully known as Application Programming Interface , API is a software middle person that allows your applications to talk with one another. It...
New API Lets App Developers Authenticate Users via SIM Cards
Online account creation poses a challenge for engineers and system architects: if you put up too many barriers, you risk turning away genuine users. Make it too easy, and you risk fraud or fake accounts. The Problem with Identity Verification The traditional model of online identity –...
GHSA-MG2G-8PWJ-R2J2 Authentication bypass in SilverStripe GraphQL
The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though. Basic-auth has been removed as a default...
Authentication bypass in SilverStripe GraphQL
The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though. Basic-auth has been removed as a default...
CVE-2020-26136
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA multi-factor authentication when using basic authentication...