CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

VulnCheck KEV: CVE-2024-39891

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy...

CVE-2024-39891

CVE-2024-39891 describes a information-disclosure bug in the Twilio Authy API: an unauthenticated endpoint accepts a stream of phone numbers and returns whether each is registered with Authy. Affected software is Twilio Authy on Android before 25.1.0 and iOS before 26.1.0. The vulnerability was e...

Twilio Authy API Security Vulnerability

Twilio Authy API is an authorization interface from Twilio, Inc. It is used to build two-factor authentication, passwordless login and secure authorization for developers. A security vulnerability exists in Twilio Authy API for Android versions prior to 25.1.0, Twilio Authy API for iOS versions...

PT-2024-5376 · Twilio · Twilio Authy Android +2

Name of the Vulnerable Software and Affected Versions: Twilio Authy Android versions prior to 25.1.0 Twilio Authy iOS versions prior to 26.1.0 Description: The issue concerns an unauthenticated endpoint in the Twilio Authy API that provided access to certain phone-number data. This endpoint...

WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability

Admin+ Cross Site Scripting XSS vulnerability discovered by LuxF0z Patchstack Alliance in WordPress Plugin Login with phone number versions = 1.7.35...

WordPress Login with phone number Plugin <= 1.7.35 is vulnerable to Cross Site Scripting (XSS)

Software Login with phone number Type Plugin Vulnerable versions = 1.7.35 Fixed in 1.7.36 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37429 Patch priority Low CVSS severity Low 5.9 Developer Hamid Alinia PSID f9a0d58ebaa8 Credits LuxF0z Required privilege...

PT-2024-37576 · Unknown · Tailoring Management System

Name of the Vulnerable Software and Affected Versions: Tailoring Management System version 1.0 Description: A critical issue was found in the Tailoring Management System, affecting the file customeradd.php. The manipulation of the fullname, address, phonenumber, sex, email, city, and comment...

CVE-2024-6125

The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for...

CVE-2024-6125

CVE-2024-6125 is a WordPress plugin vulnerability in Login with phone number up to version 1.7.34. The issue allows unauthenticated password resets by guessing a 6-digit numeric code because the reset code is weak and there is no limit on attempts or time. Public sources confirm the root cause as...

WordPress plugin Login with phone number security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Login with phone number plugin <= 1.7.34 - Insecure Password Reset Mechanism vulnerability

Insecure Password Reset Mechanism vulnerability discovered by István Márton in WordPress Plugin Login with phone number versions = 1.7.34...

WordPress Login with phone number Plugin <= 1.7.34 is vulnerable to Broken Access Control

Software Login with phone number Type Plugin Vulnerable versions = 1.7.34 Fixed in 1.7.35 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6125 Patch priority Low CVSS severity Low 8.1 Developer Hamid Alinia PSID b1915aa020d8 Credits István Márton Required...

LinkedIn: Can see phone numbers of others by providing mail address

The vulnerability allowed an attacker to view a user's phone number by abusing the password reset functionality. The phone number was exposed in the input field after verifying the user's email address...

CVE-2024-5150 Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check

The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activationcode' default value is empty, and the not empty check is missing in the 'lwpajaxregister' function. This makes it possible for...

WordPress plugin Login with phone number 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...