Information disclosure

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

django-mfa2 vulnerable to MFA Replay attack

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

GHSA-VW39-2WJ9-4Q86 django-mfa2 vulnerable to MFA Replay attack

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

CVE-2022-42731

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

Design/Logic Flaw

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

PYSEC-2022-303

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

PYSEC-2022-303

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

CVE-2022-42731

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

PT-2022-26522 · Unknown · Django-Mfa2

Name of the Vulnerable Software and Affected Versions: django-mfa2 versions 2.5.0 through 2.5.1 django-mfa2 versions 2.6.0 through 2.6.0 Description: The issue allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated aft...

PT-2022-6152 · Sap · Sap Customer Data Cloud

Name of the Vulnerable Software and Affected Versions: SAP Customer Data Cloud Gigya mobile app for Android version 7.4 Description: The issue is related to an insufficiently robust encryption method used by the software, which lacks proper diffusion and does not effectively hide patterns. This c...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-42731

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

django-mfa2 安全漏洞

django-mfa2 is a Django application that handles MFA by Mohamed El-Kalioby Personal Developer. Supports TOTP, U2F, FIDO2 U2F Webauthn, email tokens and trusted devices. A security vulnerability exists in django-mfa2 versions prior to 2.5.1, and 2.6.x versions prior to 2.6.1, which stems from a...

CVE-2022-42731

CVE-2022-42731 affects django-mfa2, specifically the mfa/FIDO2.py component. The vulnerability is a replay attack where the device registration challenge is not invalidated after use, enabling an attacker to register another device for a user. Affected versions are before 2.5.1 and 2.6.x before 2...

CVE-2022-42731

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

Direct usage of execute() may leave unintended replayable orders

Lines of code Vulnerability details Impact A user might unexpectedly have his order replayed. Proof of Concept The usage of execute is ambiguous. Either the user attemps to match and execute any two already placed orders, or he has found an order of interest and calls execute with a new order...

Brazilian Prilex Hackers Resurfaced With Sophisticated Point-of-Sale Malware

A Brazilian threat actor known as Prilex has resurfaced after a year-long operational hiatus with an advanced and complex malware to steal money by means of fraudulent transactions. "The Prilex group has shown a high level of knowledge about credit and debit card transactions, and how software us...

GSD-2022-1006317 btrfs: reject log replay if there is unsupported RO compat flag

btrfs: reject log replay if there is unsupported RO compat flag This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.326 by commit...

GSD-2022-1006274 btrfs: reject log replay if there is unsupported RO compat flag

btrfs: reject log replay if there is unsupported RO compat flag This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...