Authentication flaw

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

aimmo (>=0.57.1b6141, <=0.61.8b52), cfl-common (>=4.0.0, <=4.14.2) +2 more potentially affected by CVE-2020-15105 via django-two-factor-auth (>=1.5.0, <=1.9.1)

django-two-factor-auth PYPI version =1.5.0, =0.57.1b6141, =4.0.0, =1.1.1, =2.4.0, =2.4.12 Source cves: CVE-2020-15105 Source advisory: OSV:PYSEC-2020-39...

CVE-2020-15105 In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

CVE-2020-15105

Django Two-Factor Authentication (django-two-factor-auth) vulnerability CVE-2020-15105 affects versions up to 1.11. It stores the user’s password in clear text (base64-encoded) in the user session after the user submits credentials, until authentication completes via a 2FA code. Depending on sess...

aimmo (>=0.57.1b6141, <=0.61.8b52), cfl-common (>=4.0.0, <=4.14.2) +2 more potentially affected by CVE-2020-15105 via django-two-factor-auth (>=1.5.0, <=1.9.1)

django-two-factor-auth PYPI version =1.5.0, =0.57.1b6141, =4.0.0, =1.1.1, =2.4.0, =2.4.12 Source cves: CVE-2020-15105 Source advisory: MEND:CVE-2020-15105...

CVE-2020-15105

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

aimmo (>=0.57.1b6141, <=0.61.8b52), cfl-common (>=4.0.0, <=4.14.2) +2 more potentially affected by CVE-2020-15105 via django-two-factor-auth (>=1.5.0, <=1.9.1)

django-two-factor-auth PYPI version =1.5.0, =0.57.1b6141, =4.0.0, =1.1.1, =2.4.0, =2.4.12 Source cves: CVE-2020-15105 Source advisory: OSV:GHSA-VHR6-PVJM-9QWF...

aimmo (>=0.57.1b6141, <=0.61.8b52), cfl-common (>=4.0.0, <=4.14.2) +2 more potentially affected by CVE-2020-15105 via django-two-factor-auth (>=1.5.0, <=1.9.1)

django-two-factor-auth PYPI version =1.5.0, =0.57.1b6141, =4.0.0, =1.1.1, =2.4.0, =2.4.12 Source cves: CVE-2020-15105 Source advisory: GHSA-VHR6-PVJM-9QWF...

CVE-2020-15105: Cleartext Storage of Sensitive Information

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

PT-2020-14188

Name of the Vulnerable Software and Affected Versions Django Two-Factor Authentication versions prior to 1.12 Description The issue allows the storage of a user's password in clear text in the user session, which can be base64-encoded. This occurs when a user submits their username and password a...

Cerberus Banking Trojan Unleashed on Google Play

A malicious Android app has been uncovered on the Google Play app marketplace that is distributing the banking trojan, Cerberus. The app has 10,000 downloads. Researchers said that the trojan was found within the last few days, as it was being spread via a Spanish currency converter app called...

E-Verify’s “SSN Lock” is Nothing of the Sort

One of the most-read advice columns on this site is a 2018 piece called "Plant Your Flag, Mark Your Territory," which tried to impress upon readers the importance of creating accounts at websites like those at the Social Security Administration, the IRS and others before crooks do it for you. A k...

Congrats, you got everyone remote. But did you do it securely?

The lockdown has meant entire companies of typically office based staff being forced to work from home. The change to our way of life is like nothing anyone has in living memory ever seen. However, alongside that, IT teams have had to rush to deliver solutions that were simply not designed for th...

Broad, Ongoing Cyberattacks Targeting Australia Underscore Need for Behavioral-Based Cybersecurity

On Friday the Australian Federal Government detailed sustained ‘copy-paste’ threats on government and business throughout the country. According to the Government: “‘Copy-paste compromises’ is derived from … heavy use of proof-of-concept exploit code, web shells and other tools copied almost...

Turn on MFA Before Crooks Do It For You

Hundreds of popular websites now offer some form of multi-factor authentication MFA, which can help users safeguard access to accounts when their password is breached or stolen. But people who don't take advantage of these added safeguards may find it far more difficult to regain access when thei...

With Pre-Auth policy in place, users get “Error: Not a privilege User” after logging in

From client machine Access website EPA kicks in and successful EPA response Got the login page Two factor Enter the Username and password Got an error “Not a privilege user” and stuck at /cgi/login...

PT-2020-10845

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description The issue concerns the mishandling of brute-force attacks against Multi-Factor Authentication MFA in the affected software. Recommendations For versions prior to 5.8.0, update to version...

Premier League's Return: A Hat Trick of Cyberthreats?

England’s Premier League is returning this week, with millions of soccer fans around the world looking to stream matches using their online video accounts. Unfortunately, the U.K.’s National Cyber Security Centre NCSC is warning on phishing, fraud and brute-forcing attempts by attackers looking t...

EulerOS 2.0 SP2 : bind (EulerOS-SA-2020-1676)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can,...

Citrix Systems XenApp Information Disclosure Vulnerability

Citrix Systems XenApp is a suite of application virtualization software from Citrix Systems USA. The software supports the distribution and streaming of applications from a centralized location to an isolated environment and the execution of those applications on the target device. An information...