CVE-2024-21543

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks...

Hackers Using Fake Microsoft ADFS Login Pages to Steal Credentials

A global phishing campaign is actively exploiting a legacy Microsoft authentication system to steal user credentials and bypass multi-factor authentication MFA, targeting over 150 organizations...

CVE-2024-38523

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-45404

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the...

CVE-2024-24771

Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials username + password compromised could potentially have the second-factor authentication...

CVE-2024-31136

In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter...

Fedora 40 : ovn (2025-721a8bada2)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-721a8bada2 advisory. Update the OVN sources to upstream release v24.09.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

CVE-2024-40713

A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication MFA settings and bypass MFA...

CVE-2024-0324

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppbtwofactorauthenticationsettingsupdate' function in all versions up to, and including...

[SECURITY] [DLA 4040-1] pam-u2f security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4040-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort February 03, 2025 https://wiki.debian.org/LTS -...

LemonLDAP::NG Security Vulnerability

LemonLDAP::NG is LemonLDAP::NG open source set of Web single sign-on and access management software. A security vulnerability exists in LemonLDAP::NG that stems from cross-site request forgery during the 2FA registration process, which could lead to a victim performing a malicious operation...

DRUPAL-CONTRIB-2025-009

This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devices including phones. The module does not properly protect its custom paths, allowing one user to access a different user's two factor configuration...

Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

This module allows a site to setup two factor authentication via QR code using authenticator applications on mobile devices including phones. The module does not properly protect its custom paths, allowing one user to access a different user's two factor configuration...

Fedora 41 : abseil-cpp (2025-7631628ba6)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-7631628ba6 advisory. Update to 20240722.1 - Fix potential integer overflow in hash container create/resize Tenable has extracted the preceding description block directly from the...

Debian dsa-5853 : libpam-u2f - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5853 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5853-1 [email protected] https://www.debian.org/security/...

U.S. Dept Of Defense: 2FA Bypass via Response Manipulation on Login Page

A vulnerability was discovered in the Two-Factor Authentication 2FA mechanism of the website. The vulnerability allowed bypassing the 2FA verification process by intercepting and manipulating the server's response. As a result, an attacker could gain unauthorized access to an account after...

[SECURITY] Fedora 40 Update: freeipa-4.12.2-3.fc40

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

UBUNTU-CVE-2024-52948

CSRF on 2FA registration...

Google Ads Users Targeted in Malvertising Scam Stealing Credentials and 2FA Codes

Cybersecurity researchers have alerted to a new malvertising campaign that's targeting individuals and businesses advertising via Google Ads by attempting to phish for their credentials via fraudulent ads on Google. "The scheme consists of stealing as many advertiser accounts as possible by...