1469 matches found
CVE-2024-10924-PoC
PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 WordPressのWebページにアクセスすると、脆弱なプラグインを介してMFAが有効になっていることがわかります。 PoCを実行し、アクセスデータを提供する必要があります。 自動的に、管理パネル内の一時的な.htmlファイルを介してブラウザが開きます。 このシナリオを再現するために脆弱な環境を自動的に展開するには、次のリポジトリを使用できます。...
-CVE-2022-22954-scanner
CVE-2022-22954-scanner Einführung in die Schwachstelle VMware Workspace ONE Access früher bekannt als VMware Identity Manager ermöglicht Ihren Mitarbeitern über Multi-Faktor-Authentifizierung, bedingten Zugriff und Single Sign-On einen schnelleren Zugriff auf SaaS-, Web- und native mobile...
CVE-2026-73337
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-73337
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
SimpleHelp 5.5.x < 5.5.16 OIDC Authentication Bypass
The version of SimpleHelp running on the remote web server is 5.5.x prior to 5.5.16 or a 6.0 pre-release prior to 6.0 RC2. It is, therefore, affected by an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during...
Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People
Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at...
GHSA-JM22-3W23-5Q7W Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
CVE-2026-67611
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
CVE-2026-67611
OpenEMR up to version 8.2.0 is affected by an authentication bypass via the OAuth2 password grant flow exposed through an unauthenticated client registration endpoint. The vulnerability enables an attacker with valid credentials to register an OAuth2 client via the unauthenticated endpoint and th...
CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
CVE-2026-67611
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971
The CVE-2026-16971 entry concerns the IRIS web application (noted around version 2.4.26) where MFA validation is not protected against brute-force attempts. The connected CVE records consistently describe insufficient brute-force protection for OTP validation, indicating that an attacker could re...
CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
