CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

Devise-Two-Factor 安全漏洞

Devise-Two-Factor is a minimalist extension to Devise. It is used to provide support for two-factor authentication via the TOTP scheme. A security vulnerability in versions of Devise-Two-Factor prior to 4.0.2 allows an attacker to reapply a one-time password OTP to one and only one immediately...

Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

PT-2022-11802 · Unknown +3 · Devise-Two-Factor +3

Name of the Vulnerable Software and Affected Versions: devise-two-factor versions prior to 4.0.2 Description: The issue allows reusing a One-Time-Password OTP for one immediately trailing interval due to an incomplete fix. Recommendations: For versions prior to 4.0.2, update to version 4.0.2 or...

Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

Failed to add device when registering with OTP

Failed to add device when configuring OTP One Time Password...

Google Chrome 代码问题漏洞

Google Chrome is a web browser from Google, Inc.V8 is one of the open source JavaScript engines. A code issue vulnerability exists in Google Chrome due to incorrect input validation in the WebOTP component in Google Chrome. A remote attacker could trick a victim into opening a specially crafted w...

CVE-2022-25838

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-44161

The CVE-2021-44161 entry concerns panorama Mobile One Time Password (MOTP) from China Panorama. The issue: a specific function parameter is not properly validated, enabling SQL injection from an attacker on the same local network to read, modify, or delete the backend database. Connected sources ...

CVE-2021-44161 Changing Information Technology Inc. MOTP(Mobile One Time Password) - SQL Injection

Changing MOTP Mobile One Time Password system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication...

panorama Mobile One Time Password SQL注入漏洞

panorama Mobile One Time Password MOTP is a mobile dynamic password system of China Panorama. With a solid two-factor authentication mechanism, through the OTP dynamic password constantly changing characteristics, effectively solve the problem of account, password theft, to ensure the security of...

CVE-2020-27416

Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account...

Maharashtra State Electricity Distribution Mahavitaran 代码问题漏洞

Maharashtra State Electricity Distribution Mahavitaran is an official application of Maharashtra State Electricity Distribution, India. A security vulnerability exists in the Mahavitaran android application version 7.50 and earlier, which stems from improper OTP authentication subject to account...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

Mahavitaran 授权问题漏洞

Maharashtra State Electricity Distribution Mahavitaran is an official application of Maharashtra State Electricity Distribution, India. A security vulnerability exists in the previous version of Mahavitara 8.20 machine, which stems from an OTP fixation vulnerability in the software due to the...

GHSA-4GF2-XV97-63M2 Exposure of Sensitive Information in keycloak

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...

Insecure Randomness

Overview otp-generator is an One time password generator Affected versions of this package are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack. Remediation Upgrade otp-generator to version 3.0.0 or higher. References ...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

Tiny Tiny RSS 安全漏洞

Tiny Tiny RSStt-rss,tt-rss is an open source based browser-based news feed reader and aggregator. Tiny Tiny RSS before 2021-03-12 A security vulnerability exists that allows an attacker to log in via OTP code without a valid password...