CVE-2019-1020017

CVE-2019-1020017 affects Discourse prior to 2.3.0 and 2.4.x prior to 2.4.0.beta3, where logging in via a user-api OTP lacks a confirmation screen. The vulnerability originates from improper flow gating during OTP-based login, enabling potential unintended access without explicit user confirmation...

Authentication Bypass

Overview Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package's totp.validate function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens...

Trellix: Vulnerability Report: NO RATE LIMIT Password RESET

A vulnerability was found where there was no limit to the number of password reset requests that could be sent to a user. This could allow an attacker who obtained a user's session to send an unlimited number of OTPs to the user, potentially leading to denial of service...

CVE-2019-7218

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

Cross site request forgery (csrf)

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

Authentication flaw

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

CVE-2019-7217

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2019-1000014

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirro...

CVE-2019-1000014

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirro...

Design/Logic Flaw

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirro...

CVE-2019-1000014

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirro...

CVE-2019-1000014

Erlang/OTP Rebar3 versions 3.7.0–3.7.5 contain a Signing oracle vulnerability in Package registry verification that can allow code execution when victims fetch packages from a malicious/compromised mirror; fixed in 3.8.0.

CVE-2019-1000014

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirro...

Threatpost Survey Says: 2FA is Just Fine, But Go Ahead and Kill SMS

The author of a recently released penetration testing tool called Modlishka, which can bypass mainstream two-factor authentication 2FA, asked a provocative question in a recently published research note: “Is 2FA broken?” Since this isn’t the first example of how 2FA can be defeated, we asked...

CFP Time: Missing Two Factor Authentication in /admin/login

Hello Team, First of all this report is just mainly concern for Suggested security improvements based on your policy page. If and only if not mean possible, please do let me know. Thanks! INTRODUCTION Administrative panel is one of the main entry point for the website owner to manage their web ap...

Unspecified vulnerability in BHIM application for Android (CNVD-2019-41447)

BHIM application for Android is an Android platform based mobile payment application by National Payments India. A security vulnerability exists in the National Payments Corporation in version 1.3 of the India BHIM application for Android-based platform, which stems from the program's reliance on...

Unspecified vulnerability in BHIM application for Android (CNVD-2019-41445)

BHIM application for Android is an Android platform based mobile payment application by National Payments India. A security vulnerability exists in National Payments Corporation in version 1.3 of the India BHIM application for Android-based platform, which stems from the program not properly...

GHSA-X489-JJWM-52G7 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password aka OTP, which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing ...

Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password aka OTP, which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing ...

Authentication flaw

The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP feature, which makes it easier for attackers to bypass authentication...