Improper Authentication in CraftCMS two factor authentication plugin

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

GHSA-3P4X-GRPM-XW58 Password hash exposed in CraftCMS two factor authentication plugin

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5657

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5658

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658 CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658 CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658 CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CVE-2024-5658

The CVE-2024-5658 entry affects the CraftCMS plugin “Two-Factor Authentication” (versions up to 3.3.3). The root cause is that TOTP tokens can be reused within their validity period, which is described as an improper authentication vulnerability that may allow bypassing 2FA. Practical impact is l...

CVE-2024-5657

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5657 CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5657 CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

CVE-2024-5657: Serializable Class Containing Sensitive Data

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...

PT-2024-36875

Name of the Vulnerable Software and Affected Versions CraftCMS plugin Two-Factor Authentication versions 3.3.1 through 3.3.3 Description The issue discloses the password hash of the currently authenticated user after submitting a valid TOTP. Recommendations For versions 3.3.1 through 3.3.3,...

CraftCMS Security Vulnerability

CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in the CraftCMS plugin Two-Factor Authentication version 3.3.1, version 3.3.2, and version 3.3.3, which stems from a vulnerability that allows for multiple reuse of TOTP tokens during the validity period...

PT-2024-36886

Name of the Vulnerable Software and Affected Versions CraftCMS plugin Two-Factor Authentication versions 3.3.3 and earlier Description The issue allows reuse of TOTP tokens multiple times within the validity period. Recommendations For versions 3.3.3 and earlier, update to a version that contains...

CVE-2024-5658: Incorrect Implementation of Authentication Algorithm

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...

CraftCMS Security Vulnerability

CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in CraftCMS plugin Two-Factor Authentication version 3.3.1, 3.3.2, and 3.3.3, which stems from a vulnerability that allows disclosure of a user's password hash...

Debt collection agency FBCS leaks information of 3 million US citizens

The US debt collection agency Financial Business and Consumer Solutions FBCS has filed a data breach notification, listing the the total number of people affected as 3,226,631. FBCS is a nationally licensed, third-party collection agency that collects commercial and consumer debts, with most of i...

Ticketmaster confirms customer data breach

Live Nation Entertainment has confirmed what everyone has been speculating on for the last week: Ticketmaster has suffered a data breach. In a filing with the SEC, Live Nation said on May 20th it identified "unauthorized activity within a third-party cloud database environment containing Company...