22 matches found
zappzarapp-php-security
⚡ zappzarapp/security CSP、セキュリティヘッダー、CSRF保護、セキュアクッキー、パスワード検証、入力サニタイズ、レート制限、SRI、シークレット読み込み、暗号化、セッションセキュリティ、TOTP二要素認証、署名付きURL、セキュリティイベントログを提供する包括的なPHPセキュリティライブラリです。 主な特長 オールインワン — 単一の構成可能なパッケージに17のセキュリティモジュール デフォルトでセキュア — 厳格なCSP、unsafe-なし、HTTPS優先 フレームワーク非依存 — 任意のPHP 8.4+アプリケーションで動作 イミュータブル＆型安全 —...
about_cobaltstrike4.5_cdf
aboutcobaltstrike4.5cdf cobaltstrike4.5バージョンのクラック、checksum8特徴の除去、BeaconEyeの回避、誤ったパスによるstageリークの修正、TOTP二要素認証の追加、CVE-2022-39197の修正など このプロジェクトをお探しの場合：cobaltstrike4.5cdf はい、またもやブロックされました：Repository unavailable due to DMCA takedown...
CVE-2026-84306
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...
PT-2026-84400
Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.6 Filament versions prior to 5.7.6 Description An issue exists in the handling of one-time codes for app-based multi-factor authentication MFA. The AppAuthentication::verifyCode function uses a cache key derived...
Replay Attack
Overview Affected versions of this package are vulnerable to Replay Attack in the TOTP authentication process. An attacker can gain unauthorized access by reusing a previously valid one-time password across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path. Remediation Upgra...
Replay Attack
Overview Affected versions of this package are vulnerable to Replay Attack in the TOTP authentication process. An attacker can gain unauthorized access by reusing a previously valid one-time password across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path. Remediation Upgra...
EUVD-2021-12784
Malware in sbrugna...
EUVD-2024-37392
Malicious code in bioql PyPI...
CVE-2021-25918
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
CVE-2025-30236
Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code skipping a password check if an HTTP POST request contains a SESSION parameter...
CVE-2024-38523
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...
Migration of Android Devices registered via GCM to FCM
There is no automatic update from Azure Notification Hub or Google Push Notification Service to migrate Android clients from the FCM legacy protocol to the latest FCMv1 protocol. As a result, affected users will need to manually re-register their devices with NetScaler Gateway. Please refer to th...
HackerOne: TOTP Authenticator implementation Accepts Expired Codes
Vulnerability description not provided...
CVE-2024-38523
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...
CVE-2024-38523
Hush Line vulnerability CVE-2024-38523 affects the Hush Line OTP flow. The issue is a lack of 2FA for changing security settings, enabling an attacker using CSRF or XSS primitives to alter settings without user interaction and credentials being required. The problem is mitigated in version 0.10. ...
CVE-2024-38523 Hush Line OTP issue
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...
CVE-2021-25918
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
CVE-2021-25918
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
Cross site scripting
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
CVE-2021-25918
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...