Drupal One Time Password 安全漏洞

Drupal One Time Password is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal One Time Password versions prior to 1.3.0 that stems from bypassing authentication using an alternate path or channel, which could lead to...

WordPress Digits OTP Authentication Bypass

WordPress Digits plugin versions prior to 8.4.6.1 suffer from an OTP authentication bypass vulnerability...

Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...

Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email accou...

Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent TFA from being bypassed when using the REST login routes. A new requirements check has been added to the status report so other...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid...

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently check whether the TOTP token is already used or not for authenticator-based second-factor methods. This vulnerability is mitigated by the fact that an attacker must...

CVE-2025-42600

This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password OTP attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to...

Mytel Telecom Online Account System 安全漏洞

Mytel Telecom Online Account System is a telecom online account system from Mytel Myanmar. A security vulnerability exists in Mytel Telecom Online Account System version 1.0, which originates from an OTP authentication bypass...

CVE-2025-42600

This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password OTP attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to...

CVE-2025-42600 Brute Force Attack Vulnerability in Meon KYC solutions

This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password OTP attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to...

CVE-2025-42600

CVE-2025-42600 affects Meon KYC solutions and is tied to missing restrictions on the number of incorrect OTP attempts in certain login API endpoints. The vulnerability allows brute-forcing OTPs and could enable unauthorized access to other user accounts. Documented details consistently describe t...

PT-2025-17611 · Unknown · Meon Kyc Solutions

Name of the Vulnerable Software and Affected Versions: Meon KYC solutions affected versions not specified Description: The issue is caused by missing restrictions on the number of incorrect One-Time Password OTP attempts through certain API endpoints of the login process. A remote attacker could...

Meon KYC 安全漏洞

Meon KYC is a solution from Meon India. Meon KYC has a security vulnerability that stems from the lack of a limit on the number of incorrect one-time password attempts at certain API endpoints during the login process, which could lead to brute-force breaking attacks...

oath-toolkit: Local root exploit in a PAM module

A vulnerability was found in a PAM module, the oath-toolkit. The module gained a feature that allowed placing the OTP state file, called the usersfile, in the home directory of the to-be-authenticated user. The PAM module performed unsafe file operations in the users' home directories. Since PAM...

Rising Technosoft CAP back office application 安全漏洞

Rising Technosoft CAP back office application is a back office application from Rising Technosoft India. A security vulnerability exists in Rising Technosoft CAP back office application, which stems from a lack of OTP request rate limiting on the API endpoint, which could lead to OTP bombing or...

Linux Distros Unpatched Vulnerability : CVE-2021-43177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and...

CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directoristgeneratepasswordresetpincode and resetuserpassword functions...