CVE-2024-0324 User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppbtwofactorauthenticationsettingsupdate' function in all versions up to, and including...

PT-2024-15470 · WordPress · User Profile Builder

Name of the Vulnerable Software and Affected Versions: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress versions up to, and including, 3.10.8 Description: The issue is related to a missing capability check on the wppb two factor...

PT-2024-1894 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member versions 2.1.3 through 2.8.2 Description: The issue is related to a SQL injection vulnerability in the Ultimate Member plugin for WordPress. This vulnerability can be exploited by unauthenticated attackers to append additional...

Riding the AI Waves: The Rise of Artificial Intelligence to Combat Cyber Threats

In nearly every segment of our lives, AI artificial intelligence now makes a significant impact: It can deliver better healthcare diagnoses and treatments; detect and reduce the risk of financial fraud; improve inventory management; and serve up the right recommendation for a streaming movie on...

10 things to do to improve your online privacy

1. Set up two-factor authentication Do this for as many of your online accounts as you can, especially the major ones like your email and social media accounts. Two-factor authentication 2FA adds an extra step of protection and makes it much harder for attackers to login as you. We recommend usin...

PT-2024-10091 · Drupal · Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Two-factor Authentication TFA versions 0.0.0 through 1.5.0 Description: The issue is related to a weak authentication vulnerability in the Two-factor Authentication TFA module for Drupal, which can be exploited to abuse authentication. This...

Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that a...

GitLab Fixes Critical Account Takeover Vulnerability

Summary: Critical GitLab vulnerability CVE-2023-7028 enables unauthorized users to take over the administrator account without user interaction. Exploiting password reset flaws, attackers can submit two emails, both target as well as attacker account leading to complete account takeover. Users wi...

Fidelity National Financial acknowledges data breach affecting 1.3 million customers

In November 2023, real estate services company Fidelity National Financial FNF got its systems knocked offline for a week after a cyberincident. As is often the case these days, it turns out that the cyberincident was very likely a ransomware attack that included a data breach. Ransomware operato...

How to Stop Your X Account From Getting Hacked Like the SEC's

The US Securities and Exchange Commission and security firm Mandiant both had their X accounts breached, possibly due to changes to X’s two-factor authentication settings. Here’s how to fix yours...

Brute Force Attack

devise-two-factor is vulnerable to Brute Force Attack. The vulnerability is due to a lack of attempt restriction of login attempts in Devise-Two-Factor. This issue, when combined with the inherent entropy limitations of the Time-based One-Time Password TOTP algorithm, This allows an attacker to...

CVE-2023-6520

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the sendbackupcodesemail function. This makes it possible for unauthenticated...

Design/Logic Flaw

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...

Cross site request forgery (csrf)

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the sendbackupcodesemail function. This makes it possible for unauthenticated...

CVE-2023-6506 WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...

CVE-2023-6520

CVE-2023-6520 covers the WP 2FA – Two-factor authentication for WordPress plugin. The vulnerability exists in versions

Mandiant's X Account Was Hacked Using Brute-Force Attack

The compromise of Mandiant's X formerly Twitter account last week was likely the result of a "brute-force password attack," attributing the hack to a drainer-as-a-service DaaS group. "Normally, two-factor authentication would have mitigated this, but due to some team transitions and a change in X...

PT-2024-15283 · Undefined · Undefined

🚨 ZeroDay Alert in Ivanti VPN! CVE-2023-846805 & CVE-2024-21887 let attackers bypass 2FA & run code. 🛡️ Volexity links this to UTA0178, a suspected state-level actor. Urgent patching needed! 💻🔐 CyberSecurity IvantiVPN InfoSec...

WordPress Plugin WP 2FA Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Plugin WP 2FA Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...