CVE-2024-52598

2FAuth 5.4.1 fixes a pair of issues: an SSRF vulnerability and a URI validation bypass in the POST /api/v1/twofaccounts/preview endpoint. An attacker can supply a remote URI; the app may perform a GET to that URL and, if the response appears as an image, store it on the server. The URI filter che...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

POC for CVE-2024-10924 An error handling flaw in the REST API...

2FAuth 安全漏洞

2FAuth is a web application from Bubka Personal Developer for managing two-factor authentication 2FA accounts and generating their security codes. A security vulnerability exists in 2FAuth versions prior to v5.4.1 that stems from an authentication bypass issue that allows an attacker to easily...

2FAuth 安全漏洞

2FAuth is a web application for managing two-factor authentication 2FA accounts and generating their security codes by Bubka Personal Developer. A security vulnerability exists in 2FAuth versions prior to v5.4.1, which stems from incorrect headers when accessing uploaded SVGs directly and is...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

wordpress-really-simple-security-authn-bypass-exploit This is...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

wordpress-really-simple-security-authn-bypass-vulnerable-appli...

Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites

A critical authentication bypass vulnerability has been disclosed in the Really Simple Security formerly Really Simple SSL plugin for WordPress that, if successfully exploited, could grant an attacker to remotely gain full administrative access to a susceptible site. The vulnerability, tracked as...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

CVE-2024-10924 affects Really Simple Security (Free, Pro, Pro Multisite) WordPress plugin versions 9.0.0–9.1.1.1. Fault lies in improper validation of login_nonce within the two-factor REST API actions (check_login_and_get_user), enabling unauthenticated attackers to log in as any existing user (...

CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

CVE-2024-10924 Really Simple Security Free, Pro, and Pro Mul...

VulnCheck KEV: CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it...

Apereo CAS 授权问题漏洞

Apereo CAS is a web-based enterprise multilingual single sign-on solution from Apereo Open Source. An authorization issue vulnerability exists in Apereo CAS version 6.6, which stems from the /login?service page in the 2FA component containing an improper authentication issue...

WordPress Really Simple SSL Plugin Authentication Bypass to RCE

This module exploits an authentication bypass vulnerability in the WordPress Really Simple SSL plugin versions 9.0.0 to 9.1.1.1. The vulnerability allows bypassing two-factor authentication 2FA and uploading a plugin to achieve remote code execution RCE. Note: For the system to be vulnerable, 2FA...

WordPress Relais 2FA plugin <= 1.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Relais 2FA versions = 1.0...

PT-2024-39990

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.8.9 Description The issue is related to an incorrect implementation of the authentication algorithm in the Web Transfer Module, allowing users to bypass the second-factor verification and log in using only the...

WordPress plugin Relais 2FA 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...