PYSEC-2024-297

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...

OpenCTI 安全漏洞

OpenCTI is an open source cyber threat intelligence platform from OpenCTI Open Source. A security vulnerability exists in versions of OpenCTI prior to 6.2.18 that stems from a non-existent OTP rate limiting feature, so that an attacker with valid credentials or a malicious user committing interna...

WordPress Firebase OTP Authentication plugin <= 1.0.1 - Account Takeover vulnerability

Account Takeover vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Firebase OTP Authentication versions = 1.0.1...

OATH Toolkit: Privilege Escalation

Background OATH Toolkit provide components to build one-time password authentication systems. It contains shared C libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC 4226, the time-based TOTP algorithm RFC 6238, and Portable Symmetric...

PT-2024-16801

Name of the Vulnerable Software and Affected Versions Login With OTP plugin for WordPress versions up to, and including, 1.4.2 Description The issue is due to the plugin generating too weak OTP, with no attempt or time limit. This allows unauthenticated attackers to generate and brute force the...

CVE-2024-51561

This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process...

Brokerage Wave 安全漏洞

Brokerage Wave is a frontend product from Brokerage, Inc. A security vulnerability exists in Brokerage Wave version 2.0, which stems from a lack of rate limiting for OTP requests in API endpoints, which could allow an attacker to cause OTP bombardment/flooding on the target system by sending...

PT-2024-34705 · Aero · Aero

Name of the Vulnerable Software and Affected Versions: Aero affected versions not specified Description: This issue exists due to improper implementation of the OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this by intercepting and manipulating...

PT-2024-34701 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave 2.0 Description: This issue is due to missing restrictions for excessive failed authentication attempts on the API-based login. A remote attacker could exploit this by conducting a brute force attack against legitimate user OTP, MPIN, or...

Brokerage Aero 安全漏洞

Brokerage Aero is a frontend product from Brokerage, Inc. A security vulnerability exists in versions prior to Brokerage Aero 120820241550 that stems from an incorrect implementation of the OTP authentication mechanism in the API endpoint, which allows an attacker to bypass OTP authentication to...

[SECURITY] Fedora 41 Update: oath-toolkit-2.6.12-1.fc41

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

CVE-2024-9302

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verifyotpforgotpassword and updatepassword functions not having enough controls to preve...

PT-2024-39557 · WordPress · The App Builder – Create Native Android & Ios Apps On The Flight

Name of the Vulnerable Software and Affected Versions: The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions up to, and including, 5.3.7 Description: The issue is related to privilege escalation via account takeover. This is due to the verify otp forgot...

WordPress App Builder – Create Native Android & iOS Apps On The Flight plugin <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin App Builder versions = 5.3.7...

PT-2024-33003 · Digitory · Digitory Multi Channel Integrated Pos

Name of the Vulnerable Software and Affected Versions: Digitory Multi Channel Integrated POS version 1.0 Description: The issue is related to a lack of rate limiting in the OTP validation component, which allows attackers to gain access to the ordering system. This can lead to an excessive amount...

Digitory Multi Channel Integrated POS 安全漏洞

Digitory Multi Channel Integrated POS is an integrated POS system from Digitory, Inc. A security vulnerability exists in Digitory Multi Channel Integrated POS v1.0, which stems from a lack of rate limiting in the OTP validation component, allowing an attacker to access the ordering system and pla...

[SECURITY] Fedora 40 Update: oath-toolkit-2.6.12-1.fc40

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

[SECURITY] Fedora 39 Update: oath-toolkit-2.6.12-1.fc39

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools and a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

CVE-2024-9305

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...

WordPress AppPresser plugin <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin AppPresser versions = 4.4.4...