Facebook 'SilentFade' Malware Attack Stole Credentials For Years

Facebook has detailed a wide-scale Chinese malware campaign that targeted its ad platform for years and siphoned $4 million from users’ advertising accounts. The campaign was addressed by the social media’s security teams after it first became active. Dubbed SilentFade short for “Silently running...

Zivver: Two-factor authentication can be disabled when logged in without 2fa or password confirmation

When a user performed sensitive actions on an account, he/she didn't have to provide his/her password after some inactivity. This issue is now addressed and to perform actions related to account security, the user has to provide his/her password before continuing...

Activision Refutes Claims of 500K-Account Hack

After reports surfaced that 500,000 Activision accounts may have been hacked, impacting online Call of Duty CoD players, the gaming giant is disputing the claim. The alleged breach was first flagged by the oRemyy account on Twitter, and was quickly amplified by others, who claimed that accounts...

CVE-2020-3977

VMware Horizon DaaS 7.x and 8.x before 8.0.1 Update 1 contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit th...

CVE-2020-3977

CVE-2020-3977 affects VMware Horizon DaaS 7.x and 8.x prior to 8.0.1 Update 1. Root cause: broken authentication due to how first-factor authentication is handled, enabling potential bypass of two-factor authentication for an attacker with a legitimate Horizon DaaS account. Impact: partial integr...

GitLab Session Fixation Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A session fixation vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and 13.3.4. Th...

UBUNTU-CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

UBUNTU-CVE-2020-13307

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

PT-2020-13448 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A security issue was found in GitLab where it failed to revoke current user sessions when two-factor authentication was activated,...

PT-2020-13449 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered that could prohibit a user without 2 factor authentication enabled from accessing GitLab if they are...

UBUNTU-CVE-2020-13304

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

UBUNTU-CVE-2020-13297

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint...

PT-2020-13430 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered in certain cases where an invalid username could be accepted when 2FA is activated. Recommendations:...

PT-2020-13438 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A security issue was found that allows a malicious user to bypass 2-factor authentication restrictions for groups. This can be...

PT-2020-13445 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered where the same 2-factor Authentication secret code was generated, allowing an attacker to maintain...

Zoom adds Two-factor authentication (2FA) as extra layer of security

By Zara Khan Video conferencing platform Zoom has announced two-factor authentication 2FA to enhance protection by adding an extra layer of security. This is a post from HackRead.com Read the original post: Zoom adds Two-factor authentication 2FA as extra layer of security...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

DiceKeys

DiceKeys is a physical mechanism for creating and storing a 192-bit key. The idea is that you roll a special set of twenty-five dice, put them into a plastic jig, and then use an app to convert those dice into a key. You can then use that key for a variety of purposes, and regenerate it from the...

Bastillion - A Web-Based SSH Console That Centrally Manages Administrative Access To Systems

Bastillion is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys. Key management and administration is based on profiles assigned to defined users. Administrators can logi...