1903 matches found
Facebook Finally Fixes Its Two-Factor Mess
A Wawa breach, Russian spies, and more of the week's top security news...
[SECURITY] Fedora 31 Update: freeipa-4.8.3-1.fc31
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
PYSEC-2019-135
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...
Twitter Now Has Better Two-Factor Authentication, So Use It
A hacking bounty, right to repair, and more of the week's top security news...
Disney+ security and service issues: Here’s what we know so far
The long wait is over. Disney+, the new video-streaming service to rival Netflix and Amazon Prime, debuted last week to much fanfare, racking up 10 million subscribers within a single day of launch. Unfortunately, it wasn’t the kind of splash the majority of users predicted, as they were met with...
CVE-2019-18985
Pimcore before 6.2.2 lacks brute force protection for the 2FA token...
Microsoft Reports Global Cyberattacks on Sporting and Anti-Doping Organizations from Russian Espionage Actors
Microsoft publicly released information revealing an uptick in cyberattacks globally targeting anti-doping authorities and sporting organizations. The Microsoft Threat Intelligence Center MSTIC routinely tracks malicious activity originating from the Russian advanced persistent threat APT group 2...
Avast Network Breached As Hackers Target CCleaner Again
Czech antivirus vendor Avast on Monday warned that hackers were able to access its internal network using a temporary VPN account. Avast said that it believes that the intrusion, first detected on Sept. 25, was likely targeting its CCleaner business in a supply chain attack. CCleaner, which is...
WiKID Systems 2FA Enterprise Server Cross-Site Scripting Vulnerability (CNVD-2019-43367)
WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A cross-site scripting vulnerability exists in WiKID Systems 2FA Enterprise Server, which can be exploited by an attacker to inject malicious script or HTML code, which can be used to obtain sensiti...
WiKID Systems 2FA Enterprise Server searchDevices.jsp SQL Injection Vulnerability
WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A SQL injection vulnerability exists in WiKID Systems 2FA Enterprise Server searchDevices.jsp, which can be exploited by an attacker to submit a specially crafted SQL request to manipulate a databas...
CVE-2019-17115
Multiple cross-site scripting XSS vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The renderedmessage column is retrieved and displayed, unsanitized, on Logs.jsp. A remote...
CVE-2019-17114
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...
When can we get rid of passwords for good?
Or perhaps I should have asked, "Can we ever get rid of passwords for good?" The security world knows passwords are a problem. Products ship with default passwords that are never changed. People reuse old passwords or adopt easy-to-guess passwords that hackers easily defeat via brute force. Or...
Iran-Linked 'Charming Kitten' Touts New Spearphishing Tactics
An Iran-linked advanced persistent threat APT group tied to attacks on President Trump’s 2020 re-election campaign has added new spearphishing techniques to its arsenal in an apparent ramp-up in operations. Charming Kitten—which goes by a number of names, including APT35, Ajax Security Team,...
Twitter Puts Profit Ahead of User Privacy—Just Like Facebook Did Before
Twitter funneled two-factor authentication phone numbers into their ad targeting platform—but they weren't the only ones...
Twitter Uses Phone Numbers, Emails to Sell Ads
Twitter has acknowledged that user phone numbers and email addresses gathered for security purposes, as part of its two-factor authentication policy, may have been used to sell ads. It calls the move an accident. The revelation is being widely criticized for its obvious breach of user privacy,...
BlockDev Sp. Z o.o: Two-factor authentication (2FA) Bypass
Bypassing 2FA after activating it on the company forum...
WordPress two-factor-authentication plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. two-factor-authentication is a two-factor authentication plugin used in it. A cross-site scripting vulnerability exists in the WordPre...
