CVE-2024-3123

CVE-2024-3123 affects CHANGING Mobile One Time Password. The vulnerability stems from the uploading function in a hidden page that does not properly filter file types, enabling an attacker with administrator privileges to upload and execute a malicious file to run system commands. According to th...

CVE-2024-3122 CHANGING Mobile One Time Password - Arbitrary File Reading

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CVE-2024-3122

CVE-2024-3122 affects CHANGING Mobile One Time Password. The issue: file-download parameter handling flaw allows reading arbitrary files on the system, exploitable by remote attackers with administrator privileges. Documented impact: read access to arbitrary files; CVSS base score 4.9 (MEDIUM) wi...

PT-2024-23870 · Unknown · Changing Mobile One Time Password

Name of the Vulnerable Software and Affected Versions: CHANGING Mobile One Time Password affected versions not specified Description: The issue concerns a lack of proper file type filtering in the uploading function of a hidden page within CHANGING Mobile One Time Password. This allows remote...

CHANGING Mobile One Time Password Security Vulnerability

CHANGING Mobile One Time Password is a password management application from CHANGING Mobile, China. It is used to set one-time passwords for authentication or transactions. A security vulnerability exists in CHANGING Mobile One Time Password, which originates from an inability to properly filter...

PT-2024-23861 · Unknown · Changing Mobile

Name of the Vulnerable Software and Affected Versions: CHANGING Mobile affected versions not specified Description: The issue concerns the Mobile One Time Password functionality, which does not properly filter parameters for the file download feature. This allows remote attackers with administrat...

PT-2024-19947 · Hcl · Hcl Dryice Optibot Reset Station

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE Optibot Reset Station affected versions not specified Description: The issue concerns insecure encryption of One-Time Passwords OTPs in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to t...

HCL Technologies HCL DRYiCE Optibot Reset Station 安全漏洞

HCL Technologies HCL DRYiCE Lucy is an AI-powered virtual assistant from HCL Technologies, USA. A security vulnerability exists in the HCL Technologies HCL DRYiCE Optibot Reset Station that stems from being affected by insecure encryption with a one-time password OTP...

PT-2024-18728 · Samsung · Samsung Mobile Devices

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Devices affected versions not specified Description: A vulnerability allows local attackers to reconfigure OTP, enabling them to transit into RMA mode, which disables security features. This attack requires additional privilege...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL in Switzerland. A security vulnerability exists in ZITADEL versions prior to 2.50.0 that stems from an improper application locking...

MFA bombing taken to the next level

Simply put, MFA bombing also known as “push bombing” or “MFA fatigue” is a brute force attack on your patience. Cybercriminals use MFA bombing to break into accounts that are protected by multi-factor authentication MFA. MFA normally requires a user to enter a six-digit code sent by SMS, or...

GHSA-X2H8-QMJ4-G62F ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

CVE-2024-28862

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

Ruby One Time Password Library Security Vulnerability

Ruby One Time Password Library is a one-time password library for Ruby. A security vulnerability exists in Ruby One Time Password Library ROTP that stems from improperly restricted default permissions...

CVE-2024-28862

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

CVE-2024-28862 ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

CVE-2024-28862

The CVE-2024-28862 entry concerns the Ruby One Time Password library (ROTP). Affected versions had overly permissive default file permissions (0666) on Ruby .rb files, enabling potential local access/impact due to insecure permissions. The advisory advises upgrading to version 6.3.0; if patching ...