CVE-2019-17115

Multiple cross-site scripting XSS vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The renderedmessage column is retrieved and displayed, unsanitized, on Logs.jsp. A remote...

CVE-2019-17114

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...

When can we get rid of passwords for good?

Or perhaps I should have asked, "Can we ever get rid of passwords for good?" The security world knows passwords are a problem. Products ship with default passwords that are never changed. People reuse old passwords or adopt easy-to-guess passwords that hackers easily defeat via brute force. Or...

Iran-Linked 'Charming Kitten' Touts New Spearphishing Tactics

An Iran-linked advanced persistent threat APT group tied to attacks on President Trump’s 2020 re-election campaign has added new spearphishing techniques to its arsenal in an apparent ramp-up in operations. Charming Kitten—which goes by a number of names, including APT35, Ajax Security Team,...

Twitter Puts Profit Ahead of User Privacy—Just Like Facebook Did Before

Twitter funneled two-factor authentication phone numbers into their ad targeting platform—but they weren't the only ones...

Twitter Uses Phone Numbers, Emails to Sell Ads

Twitter has acknowledged that user phone numbers and email addresses gathered for security purposes, as part of its two-factor authentication policy, may have been used to sell ads. It calls the move an accident. The revelation is being widely criticized for its obvious breach of user privacy,...

BlockDev Sp. Z o.o: Two-factor authentication (2FA) Bypass

Bypassing 2FA after activating it on the company forum...

WordPress two-factor-authentication plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. two-factor-authentication is a two-factor authentication plugin used in it. A cross-site scripting vulnerability exists in the WordPre...

CVE-2015-9355

The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area...

Authentication flaw

The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area...

CVE-2015-9355

The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area...

CVE-2015-9355

CVE-2015-9355 affects the WordPress Two Factor Authentication plugin prior to version 1.1.10 and is a stored/reflected XSS vulnerability in the admin area. The vulnerability impacts the plugin’s admin UI, enabling client-side code execution. Public references (NVD, RH, CNVD, CVE lists) consistent...

Hostinger Suffers Data Breach – Resets Password For 14 Million Users

Popular web hosting provider Hostinger has been hit by a massive data breach, as a result of which the company has reset passwords for all customers as a precautionary measure. In a blog post published on Sunday, Hostinger revealed that "an unauthorized third party" breached one of its servers an...

The vulnerability of the RDP protocol implementation in Windows operating systems allows attackers to circumvent two-factor authentication mechanisms.

The vulnerability of the RDP protocol implementation in Windows operating systems is related to errors in processing RDP sessions based on NLA. Exploiting this vulnerability allows an attacker to circumvent two-factor authentication mechanisms by temporarily disconnecting via RDP and then...

cPanel Authorization Issues Vulnerability (CNVD-2019-29619)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 55.9999.141. An attacker could exploit the vulnerability to...

CVE-2016-10826

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

Authentication flaw

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

CVE-2016-10826

CVE-2016-10826 affects cPanel preceding 55.9999.141, where attackers can bypass two‑factor authentication via DNS clustering requests (SEC-93). The Red Hat/CNVD/NVD entries corroborate the vulnerability description and affected version. Remediation noted in public records is to upgrade to 55.9999...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...