PT-2024-27519 · Securenvoy · Securenvoy Mfa

Name of the Vulnerable Software and Affected Versions: SecurEnvoy MFA versions prior to 9.4.514 Description: Multiple LDAP injections vulnerabilities exist due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through bli...

Improper Input Validation

moodle/moodle is vulnerable to Improper Input Validation. The vulnerability is due to the lack of proper sanitization of the referrer URL in admin/tool/mfa/index.php, which is used directly by MFA...

GO-2024-2788 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

Moodle Logout CSRF in admin/tool/mfa/auth.php

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

GHSA-8G5H-GJWQ-W5CH Moodle Logout CSRF in admin/tool/mfa/auth.php

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

Moodle Improper Input Validation

Unsafe direct use of $SERVER'HTTPREFERER' in admin/tool/mfa/index.php. The referrer URL used by MFA required additional sanitizing, rather than being used directly...

GHSA-R2WX-46GP-RP3H Moodle Improper Input Validation

Unsafe direct use of $SERVER'HTTPREFERER' in admin/tool/mfa/index.php. The referrer URL used by MFA required additional sanitizing, rather than being used directly...

CVE-2024-34007

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

UBUNTU-CVE-2024-34007

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

CVE-2024-34007

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

CVE-2024-34007 moodle: logout CSRF in admin/tool/mfa/auth.php

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

CVE-2024-34007 moodle: logout CSRF in admin/tool/mfa/auth.php

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

CVE-2024-34007 moodle: logout CSRF in admin/tool/mfa/auth.php

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF...

CVE-2024-33999

The referrer URL used by MFA required additional sanitizing, rather than being used directly...

CVE-2024-33999

The referrer URL used by MFA required additional sanitizing, rather than being used directly...

CVE-2024-33999 moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php

The referrer URL used by MFA required additional sanitizing, rather than being used directly...

CVE-2024-33999 moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php

The referrer URL used by MFA required additional sanitizing, rather than being used directly...

PT-2024-25635 · Mfa +2 · Mfa +2

Name of the Vulnerable Software and Affected Versions: MFA affected versions not specified Description: The issue concerns the logout option within MFA, which did not include the necessary token to prevent the risk of users being inadvertently logged out via CSRF. Recommendations: At the moment,...

The 2024 Browser Security Report Uncovers How Every Web Session Could be a Security Minefield

With the browser becoming the most prevalent workspace in the enterprise, it is also turning into a popular attack vector for cyber attackers. From account takeovers to malicious extensions to phishing attacks, the browser is a means for stealing sensitive data and accessing organizational system...

#StopRansomware: Black Basta

Actions for critical infrastructure organizations to take today to mitigate cyber threats from ransomware: 1. Install updates for operating systems, software, and firmware as soon as they are released. 2. Require phishing-resistant MFA for as many services as possible. 3. Train users to recognize...