CVE-2024-28862

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

PT-2024-22612

Name of the Vulnerable Software and Affected Versions ROTP versions prior to 6.3.0 Description The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Recommendations For...

New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users

A novel phishing kit has been observed impersonating the login pages of well-known cryptocurrency services as part of an attack cluster codenamed CryptoChameleon that's designed to primarily target mobile devices. "This kit enables attackers to build carbon copies of single sign-on SSO pages, the...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server prior to version 7.2.4, which stems from otpCookie being displayed...

Devise-Two-Factor vulnerable to brute force attacks

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. Impact If a...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to one-time password bypass (CVE-2023-43045)

Summary IBM Sterling Partner Engagement Manager has addressed a reflected one-time password bypass vulnerability. Vulnerability Details CVEID: CVE-2023-43045 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a remote user to perform unauthorized actions due to improper...

CVE-2023-46754

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

Obl.ong Security Vulnerabilities

Obl.ong is a high-quality subdomain built with Rails from Obl.ong. A security vulnerability exists in versions of Obl.ong prior to 1.1.2 that stems from lax email OTP filtering, which allows an attacker to bypass authorization checks...

PT-2023-30184 · Obl.Ong · Obl.Ong

Name of the Vulnerable Software and Affected Versions: Obl.ong versions prior to 1.1.2 Description: The admin panel for Obl.ong allows authorization bypass because the email OTP feature accepts arbitrary numerical values. Recommendations: For versions prior to 1.1.2, update to version 1.1.2 or...

NetScaler native OTP (One-Time Password) device registration failure

Can't register device for native OTP authentication in NetScaler...

CVE-2023-3529

A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=IDampersandmethod=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy...

Rotem Dynamics Rotem CRM 安全漏洞

Rotem Dynamics Rotem CRM is a customer relationship management system from Rotem Dynamics. A security vulnerability exists in Rotem Dynamics Rotem CRM 20230729 and earlier versions, which stems from a problem with the file /LandingPages/api/otp/send?id=IDampersandmethod=sms, which can lead to...

PT-2023-25201 · Rotem Dynamics · Rotem Crm

Name of the Vulnerable Software and Affected Versions: Rotem Dynamics Rotem CRM up to 20230729 Description: A problematic vulnerability has been found in Rotem Dynamics Rotem CRM, affecting an unknown part of the file "/LandingPages/api/otp/send?id=ID&method=sms" of the component OTP URI Interfac...

CVE-2023-33291

In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. It cannot be exploited with e-mail addresses or phone numbers that are registered in the application...

ebankIT 安全漏洞

ebankIT is a banking software from ebankIT Portugal. A security vulnerability exists in ebankIT version 6, which stems from the ability to generate OTP messages to any e-mail address or phone number without authentication...

PT-2023-20921 · WordPress · Otp Login Woocommerce & Gravity Forms

Name of the Vulnerable Software and Affected Versions: OTP Login Woocommerce & Gravity Forms plugin for WordPress affected versions not specified Description: The OTP Login Woocommerce & Gravity Forms plugin for WordPress has an issue that allows authentication bypass. This happens because the...

How to change SMS OTP passcode length

This article introduces how to change the length of SMS OTP password...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager that originates from allowing non-administrators to view OTP keys through the user interface...

PT-2023-17355 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager Windows versions 2022.3.33.0 and prior Devolutions Remote Desktop Manager Linux versions 2022.3.2.0 and prior Description: The issue is related to a lack of access control for the OTP key on OTP entries in...

SUSE CVE-2007-2768

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...