CVE-2023-46754

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

Obl.ong Security Vulnerabilities

Obl.ong is a high-quality subdomain built with Rails from Obl.ong. A security vulnerability exists in versions of Obl.ong prior to 1.1.2 that stems from lax email OTP filtering, which allows an attacker to bypass authorization checks...

PT-2023-30184 · Obl.Ong · Obl.Ong

Name of the Vulnerable Software and Affected Versions: Obl.ong versions prior to 1.1.2 Description: The admin panel for Obl.ong allows authorization bypass because the email OTP feature accepts arbitrary numerical values. Recommendations: For versions prior to 1.1.2, update to version 1.1.2 or...

NetScaler native OTP (One-Time Password) device registration failure

Can't register device for native OTP authentication in NetScaler...

CVE-2023-3529

A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=IDampersandmethod=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy...

Rotem Dynamics Rotem CRM 安全漏洞

Rotem Dynamics Rotem CRM is a customer relationship management system from Rotem Dynamics. A security vulnerability exists in Rotem Dynamics Rotem CRM 20230729 and earlier versions, which stems from a problem with the file /LandingPages/api/otp/send?id=IDampersandmethod=sms, which can lead to...

PT-2023-25201 · Rotem Dynamics · Rotem Crm

Name of the Vulnerable Software and Affected Versions: Rotem Dynamics Rotem CRM up to 20230729 Description: A problematic vulnerability has been found in Rotem Dynamics Rotem CRM, affecting an unknown part of the file "/LandingPages/api/otp/send?id=ID&method=sms" of the component OTP URI Interfac...

CVE-2023-33291

In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. It cannot be exploited with e-mail addresses or phone numbers that are registered in the application...

ebankIT 安全漏洞

ebankIT is a banking software from ebankIT Portugal. A security vulnerability exists in ebankIT version 6, which stems from the ability to generate OTP messages to any e-mail address or phone number without authentication...

PT-2023-20921 · WordPress · Otp Login Woocommerce & Gravity Forms

Name of the Vulnerable Software and Affected Versions: OTP Login Woocommerce & Gravity Forms plugin for WordPress affected versions not specified Description: The OTP Login Woocommerce & Gravity Forms plugin for WordPress has an issue that allows authentication bypass. This happens because the...

How to change SMS OTP passcode length

This article introduces how to change the length of SMS OTP password...

PT-2023-17355 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager Windows versions 2022.3.33.0 and prior Devolutions Remote Desktop Manager Linux versions 2022.3.2.0 and prior Description: The issue is related to a lack of access control for the OTP key on OTP entries in...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager that originates from allowing non-administrators to view OTP keys through the user interface...

SUSE CVE-2007-2768

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

SUSE CVE-2020-1744

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...

This Malicious App Abused Hacked Devices to Create Fake Accounts on Multiple Platforms

A malicious Android SMS application discovered on the Google Play Store has been found to stealthily harvest text messages with the goal of creating accounts on a wide range of platforms like Facebook, Google, and WhatsApp. The app, named Symoo com.vanjan.sms, had over 100,000 downloads and...

CVE-2022-41986

Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain a one-time password issued by the product under certain conditions...

CVE-2022-41986

Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain a one-time password issued by the product under certain conditions...

Information disclosure

Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain a one-time password issued by the product under certain conditions...

CVE-2022-41986

Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain a one-time password issued by the product under certain conditions...