OATH Toolkit: Privilege Escalation

Background OATH Toolkit provide components to build one-time password authentication systems. It contains shared C libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC 4226, the time-based TOTP algorithm RFC 6238, and Portable Symmetric...

PT-2024-16801

Name of the Vulnerable Software and Affected Versions Login With OTP plugin for WordPress versions up to, and including, 1.4.2 Description The issue is due to the plugin generating too weak OTP, with no attempt or time limit. This allows unauthenticated attackers to generate and brute force the...

CVE-2024-51561

This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process...

Brokerage Wave 安全漏洞

Brokerage Wave is a frontend product from Brokerage, Inc. A security vulnerability exists in Brokerage Wave version 2.0, which stems from a lack of rate limiting for OTP requests in API endpoints, which could allow an attacker to cause OTP bombardment/flooding on the target system by sending...

PT-2024-34705 · Aero · Aero

Name of the Vulnerable Software and Affected Versions: Aero affected versions not specified Description: This issue exists due to improper implementation of the OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this by intercepting and manipulating...

PT-2024-34701 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave 2.0 Description: This issue is due to missing restrictions for excessive failed authentication attempts on the API-based login. A remote attacker could exploit this by conducting a brute force attack against legitimate user OTP, MPIN, or...

Brokerage Aero 安全漏洞

Brokerage Aero is a frontend product from Brokerage, Inc. A security vulnerability exists in versions prior to Brokerage Aero 120820241550 that stems from an incorrect implementation of the OTP authentication mechanism in the API endpoint, which allows an attacker to bypass OTP authentication to...

[SECURITY] Fedora 41 Update: oath-toolkit-2.6.12-1.fc41

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

CVE-2024-9302

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verifyotpforgotpassword and updatepassword functions not having enough controls to preve...

PT-2024-39557 · WordPress · The App Builder – Create Native Android & Ios Apps On The Flight

Name of the Vulnerable Software and Affected Versions: The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions up to, and including, 5.3.7 Description: The issue is related to privilege escalation via account takeover. This is due to the verify otp forgot...

WordPress App Builder – Create Native Android & iOS Apps On The Flight plugin <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin App Builder versions = 5.3.7...

Digitory Multi Channel Integrated POS 安全漏洞

Digitory Multi Channel Integrated POS is an integrated POS system from Digitory, Inc. A security vulnerability exists in Digitory Multi Channel Integrated POS v1.0, which stems from a lack of rate limiting in the OTP validation component, allowing an attacker to access the ordering system and pla...

PT-2024-33003 · Digitory · Digitory Multi Channel Integrated Pos

Name of the Vulnerable Software and Affected Versions: Digitory Multi Channel Integrated POS version 1.0 Description: The issue is related to a lack of rate limiting in the OTP validation component, which allows attackers to gain access to the ordering system. This can lead to an excessive amount...

[SECURITY] Fedora 40 Update: oath-toolkit-2.6.12-1.fc40

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

[SECURITY] Fedora 39 Update: oath-toolkit-2.6.12-1.fc39

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

CVE-2024-9305

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...

WordPress AppPresser plugin <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin AppPresser versions = 4.4.4...

The vulnerability of the implementation of the OTP mechanism in the OATH Toolkit software for authentication allows a perpetrator to increase their privileges.

The vulnerability of the OATH Toolkit software’sOTP mechanism is related to the incorrect definition of symbolic links before accessing a file. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level and create symbolic links to critical system files...

OATH Toolkit 安全漏洞

OATH Toolkit is an open source toolkit from deepin. A security vulnerability exists in OATH Toolkit versions 2.6.7 through 2.6.11, which stems from a PAM module that allows a malicious user to compromise the environment when placing an OTP status file in a user's home directory...

Shilpi Client Dashboard 安全漏洞

Shilpi Client Dashboard is a centralized dashboard from Shilpi. A security vulnerability exists in Shilpi Client Dashboard versions prior to 9.7.0, which stems from a lack of rate limiting and CAPTCHA protection for OTP requests in the API endpoints, and could lead to an OTP explosion on the targ...