PT-2024-33672 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 1.11.8 Description: When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TL...

WordPress WP 2FA with Telegram plugin <= 3.0 - Authenticated (Subscriber+) Authentication Bypass vulnerability

Authenticated Subscriber+ Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin WP 2FA with Telegram versions = 3.0...

WordPress WP 2FA with Telegram plugin <= 3.0 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin WP 2FA with Telegram versions = 3.0...

CVE-2024-9820

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication...

CVE-2024-9687

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-9820 WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication...

CVE-2024-9820 WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication...

WordPress plugin WP 2FA with Telegram 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin WP 2FA with Telegram 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Internet Archive suffers data breach and DDoS

A non-profit that benefits millions of people has fallen victim to a data breach and a DDoS attack. Internet Archive, most known for its Wayback Machine, is a digital library that allows users to look at website snapshots from the past. It is often used for academic research and data analysis...

CVE-2024-48942

The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...

PT-2024-33288 · Atlassian +1 · Confluence +3

Name of the Vulnerable Software and Affected Versions: Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket versions 3.1.4.5 and earlier Description: The issue allows remote attackers to easily brute-force the 2FA PIN via the "plugins/servlet/twofactor/public/pinvalidation" endpoin...

MoneyGram confirms customer data breach

Money transfer company MoneyGram has notified its customers of a data breach in which it says certain customers had their personal information taken between September 20 and 22, 2024. The investigation into the incident that was discovered on September 27 is still ongoing, and the number of...

Radiology provider exposed tens of thousands of patient files

An anonymous person has disclosed that they gained online access to a radiologist's platform that hosted patient information using stolen credentials. I-MED Radiology is Australia’s leading medical imaging provider. Their clinics offer a range of imaging procedures including MRI, CT, x-ray,...

PT-2025-2098 · Drupal · Drupal Facets

Name of the Vulnerable Software and Affected Versions: Drupal Facets versions 0.0.0 through 2.0.9 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can be exploited by a remote attacker to hijack a user's...

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently migrate sessions before prompting for a second factor token. This vulnerability is mitigated by the fact that an attacker must fixat...

PT-2025-2094 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.8.0 Description: The issue is related to incorrect session management in the Two-factor Authentication TFA module of the Drupal CMS system. This can allow a remote attacker to hija...

Drupal Two-factor Authentication (TFA) module < 1.8.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Francesco Placella in WordPress Module Two-factor Authentication TFA versions 1.8.0...

USN-7050-1: Devise-Two-Factor vulnerabilities

Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. CVE-2021-43177 Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled...

Terraform Enterprise’s Single Sign-On And Ruby SAML’s CVE-2024-45409

Summary Terraform Enterprise’s single sign-on functionality is implemented using the Ruby SAML library, which disclosed an authentication bypass vulnerability exploitable by an XML signature wrapping attack. This vulnerability, CVE-2024-45409, was addressed by an upgrade of the Ruby SAML version...