PT-2020-4290

Name of the Vulnerable Software and Affected Versions: VMware Horizon DaaS versions 7.x and 8.x before 8.0.1 Update 1 Description: The issue is related to a broken authentication vulnerability due to a flaw in the way VMware Horizon DaaS handled the first factor authentication. This flaw may allo...

CVE-2020-10079

GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required...

CVE-2014-4198

A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function...

CVE-2014-4198: Improper Authentication

A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function...

PT-2020-7674

Name of the Vulnerable Software and Affected Versions BS-Client Private Client versions 2.4 through 2.5 Description A Two-Factor Authentication Bypass issue exists, allowing a malicious user to access privileged functions via an XML request. This request neglects the use of ADPswID and AD...

PT-2019-7622

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 55.9999.141 Description The issue allows attackers to bypass Two Factor Authentication. This is achieved via DNS clustering requests. Recommendations For versions prior to 55.9999.141, update to version 55.9999.141 or...

PT-2018-16938

Name of the Vulnerable Software and Affected Versions Navarino Infinity affected versions not specified Description The issue allows for session fixation attacks. The server accepts the session ID as a GET parameter, which can be exploited to bypass two-factor authentication in some installations...

CVE-2018-6960: Improper Authentication

VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...

PYSEC-2014-101

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind...

Flaw Lets Attackers Bypass PayPal Two-Factor Authentication

There’s a vulnerability in the way that PayPal handles certain requests from mobile clients that can allow an attacker to bypass the two-factor authentication mechanism for the service and transfer money from a victim’s account to any recipient he chooses. The flaw lies in the way that the PayPal...

CVE-2013-4177: Undefined Security Weakness

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors...

PT-2014-2749

Name of the Vulnerable Software and Affected Versions Google Authenticator login module versions 6.x-1.x before 6.x-1.2 Google Authenticator login module versions 7.x-1.x before 7.x-1.4 Description The issue is related to the Google Authenticator login module for Drupal, where it fails to properl...