1862 matches found
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
PYSEC-2022-303
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
Design/Logic Flaw
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
CVE-2022-41209: Inadequate Encryption Strength
SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...
CVE-2022-42731
CVE-2022-42731 affects django-mfa2, specifically the mfa/FIDO2.py component. The vulnerability is a replay attack where the device registration challenge is not invalidated after use, enabling an attacker to register another device for a user. Affected versions are before 2.5.1 and 2.6.x before 2...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
PT-2022-26522 ยท Unknown ยท Django-Mfa2
Name of the Vulnerable Software and Affected Versions: django-mfa2 versions 2.5.0 through 2.5.1 django-mfa2 versions 2.6.0 through 2.6.0 Description: The issue allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated aft...
django-mfa2 ๅฎๅ จๆผๆด
django-mfa2 is a Django application that handles MFA by Mohamed El-Kalioby Personal Developer. Supports TOTP, U2F, FIDO2 U2F Webauthn, email tokens and trusted devices. A security vulnerability exists in django-mfa2 versions prior to 2.5.1, and 2.6.x versions prior to 2.6.1, which stems from a...
CVE-2022-42731: Authentication Bypass by Capture-replay
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
possbile griefing using replay attack
Lines of code Vulnerability details users who want to user redeem function has to set a value for amountIn this value cant be more than redeemBase , which is set in contract's constructor. the value of redeemBase will decrease in case of a successful call of redeem . while contract's solidity...
PT-2022-24558 ยท Renault ยท Renault Zoe
Name of the Vulnerable Software and Affected Versions: Renault ZOE version 2021 Description: The remote keyless system sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack. Recommendations: For Renault ZOE version 2021, consider...
Signature Replay Attack - Signatures are reusable
Lines of code Vulnerability details checkSignatureValidity performs a check to verify that the signer is the correct address. In the case of Community this is done on the following data: uint256 communityID, address builder, address lender, address agent, address project, uint256 repayAmount, byt...
Missing EIP-155 replay attack protection
Lines of code Vulnerability details Impact publishProject/addMember/escrow in Community and inviteContractor/updateProjectHash/addTasks/setComplete/changeOrder in Project use ecrecover for signed messages to check access. However, all signed messages that is used to check access do not include an...
Direct usage of ecrecover allows signature malleability
Lines of code Vulnerability details Impact The permit function of ERC20Permit calls the Solidity ecrecover function directly to verify the given signatures. However, the ecrecover EVM opcode allows malleable non-unique signatures and thus is susceptible to replay attacks. This can leads to permit...
CVE-2022-29593
relaycgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication or a valid signed/authorized request...
Rocky Linux 8 : thunderbird (RLSA-2022:5470)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5470 advisory. - The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evidence of memory corruption and ...
CVE-2022-33208
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software...