100 million+ US citizens have records leaked by background check service

A background check left a huge database unprotected online containing 2.2TB of people's data, according to research by Cybernews. The database was left passwordless and easily accessible to anyone on the internet by background check firm MC2 Data. MC2 Data gathers publicly available data to provi...

CVE-2024-8606

Bypass of two factor authentication in RestAPI in Checkmk 2.3.0p16 and 2.2.0p34 allows authenticated users to bypass two factor authentication...

Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

Summary Under the default configuration, Devise-Two-Factor versions 1.0.0 or = 4.0.0 & 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make ...

MFASOFT Secure Authentication Server 安全漏洞

MFASOFT Secure Authentication Server is a two-factor authentication system based on one-time passwords OTP from the Russian company MFASOFT. A security vulnerability exists in MFASOFT Secure Authentication Server SAS version 1.8.x through versions prior to 1.9.040924 that stems from improper acce...

Payment provider data breach exposes credit card information of 1.7 million customers

Payment provider Slim CD has disclosed a security incident that may have exposed the full credit card information of anyone paying at a merchant that uses Slim CD’s services. The Florida-based gateway system, which allows merchants to take any kind of electronic payment, said on June 15 it notice...

Vulnerability fixed in Sonicwall SonicOS

Sonicwall has fixed a vulnerability in SonicOS for Gen5, Gen6 and Gen7 firewalls. The vulnerability is located in the management interface and SSLVPN and allows a malicious party to cause a Denial-of-Service and potentially access and modify system data. The NCSC is receiving signals from trusted...

Fortinet FortiClient 信任管理问题漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. Fortinet FortiClient is vulnerable to a trust...

The vulnerability of the two-factor authentication (2FA) mechanism of the Docker-based deployment and email server management tool, mailcow:dockerized, allows attackers to bypass 2FA protection and gain unauthorized access.

The vulnerability of the two-factor authentication 2FA mechanism in the Docker-based mailcow:dockerized deployment and management system is related to the lack of security measures for the website structure. Exploiting this vulnerability allows an attacker to bypass 2FA protection and gain...

FIWARE Keyrock Encryption Problem Vulnerability (CNVD-2024-37461)

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the algorithm used to create the disable2fakey being predictable, and can be exploited by an attacker to predict...

Basecamp: Critical Data Breach - Big Data for all domains

The researcher provided an Excel sheet that appeared to be a dump of a breach database. The origin of the data entries in the database was unclear. A small number of valid HEY accounts with enabled 2FA were found, as well as a slightly larger number of other product accounts with valid passwords...

CVE-2024-42465 Lack of resources and rate limiting - two factor authentication

Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42465 Lack of resources and rate limiting - two factor authentication

Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...

Siemens SCALANCE M-800 Series Information Disclosure Vulnerability

SCALANCE M-800, MUM-800, S615, RUGGEDCOM RM1224 are all industrial routers. An information disclosure vulnerability exists in the Siemens SCALANCE M-800 series, which originates when the device inserts sensitive information about the generation of 2FA tokens into a log file, and can be exploited ...

FIWARE Keyrock 安全漏洞

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the algorithm used to create the disable2fakey being predictable, and can be exploited by an attacker to predict...

The vulnerability of the final point of the application software interface of a two-factor authentication system based on generating security tokens with Twilio Authy allows a perpetrator to disclose sensitive information.

The vulnerability of the final point of the application software interface for two-factor authentication based on token generation by Twilio Authy is related to the disclosure of information due to incompatibility. Exploiting this vulnerability could allow a malicious actor to disclose the...

CVE-2024-41958 Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication 2FA mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized access to other accounts that are otherwi...

The vulnerability of the One-Time Password function in Securepoint Unified Threat Management (UTM) software allows a perpetrator to bypass the two-factor authentication process.

The vulnerability of the One-Time Password function in Securepoint Unified Threat Management UTM software-related microprogramming systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass two-factor authentication...

PT-2024-5830 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2024-07 Description: A vulnerability has been discovered in the two-factor authentication 2FA mechanism of mailcow: dockerized, an open source groupware/email suite based on docker. This flaw allows an...

Magento Sites Targeted with Sneaky Credit Card Skimmer via Swap Files

Threat actors have been observed using swap files in compromised websites to conceal a persistent credit card skimmer and harvest payment information. The sneaky technique, observed by Sucuri on a Magento e-commerce site's checkout page, allowed the malware to survive multiple cleanup attempts, t...

Heritage Foundation data breach containing personal data is available online

The Heritage Foundation this month denied that it had suffered an earlier system breach and the subsequent leaking of internal data. But the organization had to admit that cybercriminals gained access to an archive of Heritages affiliated media site, The Daily Signal, dating back to 2022. That...