Advance Auto Parts customer data posted for sale

A cybercriminal using the handle Sp1d3r is offering to sell 3 TB of data taken from Advance Auto Parts, Inc. Advance Auto Parts is a US automotive aftermarket parts provider that serves both professional installers and do it yourself customers. Allegedly the customer data includes: Names Email...

GHSA-96QM-HWHP-2RM8 Improper Authentication in CraftCMS two factor authentication plugin

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

GHSA-3P4X-GRPM-XW58 Password hash exposed in CraftCMS two factor authentication plugin

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

Password hash exposed in CraftCMS two factor authentication plugin

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

Improper Authentication in CraftCMS two factor authentication plugin

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5657

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5658

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658

The CVE-2024-5658 entry affects the CraftCMS plugin “Two-Factor Authentication” (versions up to 3.3.3). The root cause is that TOTP tokens can be reused within their validity period, which is described as an improper authentication vulnerability that may allow bypassing 2FA. Practical impact is l...

CVE-2024-5658 CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658 CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658 CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5657 CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5657 CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CraftCMS Security Vulnerability

CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in the CraftCMS plugin Two-Factor Authentication version 3.3.1, version 3.3.2, and version 3.3.3, which stems from a vulnerability that allows for multiple reuse of TOTP tokens during the validity period...

CraftCMS Security Vulnerability

CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in CraftCMS plugin Two-Factor Authentication version 3.3.1, 3.3.2, and 3.3.3, which stems from a vulnerability that allows disclosure of a user's password hash...

Debt collection agency FBCS leaks information of 3 million US citizens

The US debt collection agency Financial Business and Consumer Solutions FBCS has filed a data breach notification, listing the the total number of people affected as 3,226,631. FBCS is a nationally licensed, third-party collection agency that collects commercial and consumer debts, with most of i...

Ticketmaster confirms customer data breach

Live Nation Entertainment has confirmed what everyone has been speculating on for the last week: Ticketmaster has suffered a data breach. In a filing with the SEC, Live Nation said on May 20th it identified "unauthorized activity within a third-party cloud database environment containing Company...

HackerOne: Improper Authentication - 2FA OTP Reusable

Vulnerability description not provided...

GHSA-9PHW-7H96-Q3RV scheb/two-factor-bundle bypass two-factor authentication with remember-me option

In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication 2FA using the rememberme cookie. When the rememberme checkbox was used during login, a "REMEMBERME" cookie was created. Upon...

scheb/two-factor-bundle bypass two-factor authentication with remember-me option

In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication 2FA using the rememberme cookie. When the rememberme checkbox was used during login, a "REMEMBERME" cookie was created. Upon...