CVE-2014-1693

CVE-2014-1693 is a concrete vulnerability in Erlang/OTP’s FTP module where improper handling of CRLF sequences enables context-dependent attackers to inject arbitrary FTP commands. Reports from multiple advisories (Ubuntu USN-3571-1, Mageia MGASA-2014-0553, Mandriva MDVSA-2015:174, Fedora FEDORA-...

CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the 1 user, 2 account, 3 cd, 4 ls, 5 nlist, 6 rename, 7 delete, 8 mkdir, 9 rmdir, 10 recv, 11 recvbin, 12 recvchunkstart, 13 send...

CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the 1 user, 2 account, 3 cd, 4 ls, 5 nlist, 6 rename, 7 delete, 8 mkdir, 9 rmdir, 10 recv, 11 recvbin, 12 recvchunkstart, 13 send...

CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the 1 user, 2 account, 3 cd, 4 ls, 5 nlist, 6 rename, 7 delete, 8 mkdir, 9 rmdir, 10 recv, 11 recvbin, 12 recvchunkstart, 13 send...

CVE-2014-7828

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

Design/Logic Flaw

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

PYSEC-2014-104

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

CVE-2014-7828

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

PYSEC-2014-104

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

CVE-2014-7828

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

CVE-2014-7828

CVE-2014-7828 affects FreeIPA 4.0.x (before 4.0.5) and 4.1.x (before 4.1.1) where 2FA is enabled. An OTP token could bypass the password requirement, enabling a remote attacker to perform an anonymous bind. The description notes a password bypass via OTP during 2FA; no additional exploit details ...

Internet Bug Bounty: Ericsson Erlang OTP Core Allocation Subsystem Integer Overflow (All Versions)

Lab Mouse Security Report LMS-2014-06-23-7 Report ID: LMS-2014-06-23-7 Report Code Name: EARLGREY.1 Researcher Name: Don A. Bailey Researcher Organization: Lab Mouse Security Researcher Email: [email protected] Researcher Website: www.securitymouse.com Vulnerability Status: Patched...

CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

DEBIAN-CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

Deserialization of untrusted data

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

CVE-2013-5429

The CVE-2013-5429 issue affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and TFIMBG 6.2.2 before FP9. Vulnerability: Risk Based Access allows reuse of One Time Password (OTP) tokens under certain conditions, enabling a remote authenticated user to complete transactions by lev...

Ukrainian Banking App Vulnerable to Attack

Privat24, the mobile banking application for Ukraine’s largest commercial bank, contains an insufficient validation vulnerability in its iOS, Android, and Windows phone apps that could give an attacker the ability to steal money from user accounts after bypassing its two-factor authentication...