WordPress Relais 2FA plugin <= 1.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Relais 2FA versions = 1.0...

WordPress plugin Relais 2FA 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-39990

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.8.9 Description The issue is related to an incorrect implementation of the authentication algorithm in the Web Transfer Module, allowing users to bypass the second-factor verification and log in using only the...

THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 04 - Nov 10)

⚠️ Imagine this: the very tools you trust to protect you online—your two-factor authentication, your car's tech system, even your security software—turned into silent allies for hackers. Sounds like a scene from a thriller, right? Yet, in 2024, this isn't fiction; it's the new cyber reality...

Authentication Bypass

Overview djoser is a REST implementation of Django authentication system. Affected versions of this package are vulnerable to Authentication Bypass when the authenticate function fails. This is because the system falls back to querying the database directly, granting access to users with valid...

PT-2024-8207

Name of the Vulnerable Software and Affected Versions Really Simple Security Free, Pro, and Pro Multisite versions 9.0.0 through 9.1.1.1 Description The Really Simple Security plugins for WordPress are affected by an authentication bypass issue. This is due to improper user check error handling i...

New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers

Over 1,500 Android devices have been infected by a new strain of Android banking malware called ToxicPanda that allows threat actors to conduct fraudulent banking transactions. "ToxicPanda's main goal is to initiate money transfers from compromised devices via account takeover ATO using a...

PT-2024-34165 · Frappe · Press

Name of the Vulnerable Software and Affected Versions: Press versions prior to the version containing commit ba0007c28ac814260f836849bc07d29beea7deb6 Description: The issue concerns a password reset vulnerability in Press, a custom app for Frappe Cloud that manages various services including...

Press 授权问题漏洞

Press is a Frappe open source Frappe custom application running Frappe Cloud. Press suffers from an authorization issue vulnerability that stems from allowing anyone with the right to bypass 2FA access to a mailbox to reset the password...

The vulnerability of the microprogrammed software of industrial routers SCALANCE M-800, related to insufficient protection of registration data, allows a hacker to replace other users’ 2FA tokens and expose the protected information.

The vulnerability of the microprogrammed software in industrial routers SCALANCE M-800 is related to insufficient protection for registration data. Exploiting this vulnerability could allow a hacker to replace other users’ 2FA tokens and expose the protected information...

Sensitive Information Exposure

pterodactyl/panel is vulnerable to Sensitive Information Exposure. The vulnerability is due to the insecure handling of passwords in HTTP query parameters, which are logged in plain text when two-factor authentication is disabled. It can allow unauthorized access if an attacker gains access to...

100 million US citizens officially impacted by Change Healthcare data breach

In April, we reported that a “substantial proportion” of Americans may have had their health and personal data stolen in the Change Healthcare breach. That was based on a report provided by the UnitedHealth Group after the February cyberattack on its subsidiary Change Healthcare. The attack on...

CVE-2024-49762 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones...

CVE-2024-49762

CVE-2024-49762 affects the Pterodactyl Panel. When a user disables 2FA, a DELETE request includes the current password in a query parameter. Although TLS encrypts query parameters in transit, many web servers log these parameters in plaintext, potentially exposing passwords from logs if an attack...

CVE-2024-49762 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones...

Cleartext Storage in a File or on Disk

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Cleartext Storage in a File or on Disk due to the logging of sensitive information in plain text when two-factor authentication is disabled. An attacker can potentially gain unauthorized...

GHSA-C479-WQ8G-57HR Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Impact When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones officially documented for use with Pterodactyl will log query...

PT-2024-33672 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 1.11.8 Description: When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TL...

WordPress WP 2FA with Telegram plugin <= 3.0 - Authenticated (Subscriber+) Authentication Bypass vulnerability

Authenticated Subscriber+ Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin WP 2FA with Telegram versions = 3.0...

WordPress WP 2FA with Telegram plugin <= 3.0 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin WP 2FA with Telegram versions = 3.0...