CVE-2018-1638

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication TFA while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483...

Authentication flaw

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication TFA while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483...

CVE-2018-1638

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication TFA while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483...

CVE-2018-1638

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication TFA while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483...

CVE-2018-1638

The vulnerability CVE-2018-1638 affects IBM API Connect (Developer Portal) versions 5.0.0.0–5.0.8.3, where two-factor authentication (TFA) is not enforced when resetting a user password, while it is enforced for other login scenarios. This bypass could allow an attacker to gain full access if the...

A Quick-Start Introduction to Database Security: An Operational Approach

The recent SingHealth data breach incident exposed around 1.5 million patients’ records. In its aftermath, the Cyber Security Agency of Singapore published a set of security measures aimed at improving the protection of Personally Identifiable Information PII data. The recommended security measur...

Security Bulletin: API Connect is affected by a weak two factor authentication vulnerability

Summary IBM API Connect has addressed the following vulnerability. API Connect user are affected by a TwoFactor 2FA/TFA bypass while resetting password. Using API Connect version 5.0.8.3 and with Two Factor Authentication enabled on the Developer Portal it is possible to bypass TFA and get full...

Google Employees Use a Physical Token as Their Second Authentication Factor

Krebs on Security is reporting that all 85,000 Google employees use two-factor authentication with a physical token. A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security key...

Titan Security Keys – Google launches its own USB-based FIDO U2F Keys

At Google Cloud Next '18 convention in San Francisco, the company has introduced Titan Security Keys —a tiny USB device, similar to Yubico's YubiKey, that offers hardware-based two-factor authentication for your online accounts with the highest level of protection against phishing attacks. These...

Titan Security Keys – Google launches its own USB-based FIDO U2F Keys

At Google Cloud Next '18 convention in San Francisco, the company has introduced Titan Security Keys—a tiny USB device, similar to Yubico's YubiKey, that offers hardware-based two-factor authentication for your online accounts with the highest level of protection against phishing attacks. These...

CVE-2018-5385

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some...

CVE-2018-5385

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some...

Session fixation

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some...

CVE-2018-5385

CVE-2018-5385 affects Navarino Infinity web interface (up to version 2.2). The vulnerability arises from accepting the session ID as a GET parameter, enabling session fixation that can bypass two-factor authentication in some installations, with potential phishing implications. The linked sources...

CVE-2018-5385 Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some...

Google: Security Keys Neutralized Employee Phishing

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. A YubiKey Security Key made by...

Password-Guessing Was Used to Hack Gentoo Linux Github Account

Maintainers of the Gentoo Linux distribution have now revealed the impact and "root cause" of the attack that saw unknown hackers taking control of its GitHub account last week and modifying the content of its repositories and pages. The hackers not only managed to change the content in compromis...

Password-Guessing Was Used to Hack Gentoo Linux Github Account

Maintainers of the Gentoo Linux distribution have now revealed the impact and "root cause" of the attack that saw unknown hackers taking control of its GitHub account last week and modifying the content of its repositories and pages. The hackers not only managed to change the content in compromis...

TFA Basic plugins - Less critical - Insecure Randomness - SA-CONTRIB-2018-044

The TFA Basic module enables you to use Two Factor Authentication via a variety of plugins including TOTP and one-time codes delivered via email or sms. The module doesn't use a strong source of randomness, creating weak and predictable one-time login codes that are then delivered using SMS. This...

NetScaler Gateway : Radius Authentication Fails Intermittently Despite RADIUS Server Accept

NetScaler Gateway Authentication Scenario 1: Gateway Page would present the authentication to be done in 2 factor. First the user enters the LDAP username and password. Now there would be 2 options either user can do the touch authentication present in the MFA Application or else can wait for the...