1016 matches found
MFASOFT Secure Authentication Server 安全漏洞
MFASOFT Secure Authentication Server is a two-factor authentication system based on one-time passwords OTP from the Russian company MFASOFT. A security vulnerability exists in MFASOFT Secure Authentication Server SAS version 1.8.x through versions prior to 1.9.040924 that stems from improper acce...
Withdrawn Advisory: Lunary improper access control vulnerability
Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...
CVE-2024-6087 Improper Access Control in lunary-ai/lunary
An improper access control vulnerability exists in lunary-ai/lunary at the latest commit a761d83 on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target user...
Reedos aiM-Star 安全漏洞
Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1, which stems from a lack of rate limiting for OTP requests in certain API endpoints, which could allow an attacker to send multiple OTP requests through...
CVE-2024-7318 Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds default. Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passco...
keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds default. Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passco...
Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Update
New Red Hat build of Keycloak 24.0.7 packages are available from the Customer Portal Red Hat build of Keycloak 24.0.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...
Red Hat Keycloak 安全漏洞
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from an expired OTP code remaining available when using FreeOTP when the OTP tok...
PT-2024-38263
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A vulnerability was found in Keycloak where expired OTP codes are still usable when using FreeOTP with the default OTP token period of 30 seconds. Instead of expiring after 30 seconds, the...
Owners of 1-Time Passcode Theft Service Plead Guilty
Three men in the United Kingdom have pleaded guilty to operating otp.agency , a once popular online service that helped attackers intercept the one-time passcodes OTPs that many websites require as a second authentication factor in addition to passwords. Launched in November 2019, OTP Agency was ...
The vulnerability of the One-Time Password function in Securepoint Unified Threat Management (UTM) software allows a perpetrator to bypass the two-factor authentication process.
The vulnerability of the One-Time Password function in Securepoint Unified Threat Management UTM software-related microprogramming systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass two-factor authentication...
Craft CMS Allows TOTP Token To Stay Valid After Use
Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. Impact An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. A TOTP token can be used multiple times t...
CVE-2024-6637
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...
CVE-2024-6637
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...
CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...
CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...
PT-2024-37766 · WordPress · Woocommerce - Social Login
Name of the Vulnerable Software and Affected Versions: WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.7.3 Description: The issue is related to unauthenticated privilege escalation due to a lack of brute force controls on a weak one-time password. This allows...
Securepoint Unified Threat Management Security Vulnerability
Securepoint Unified Threat Management Securepoint UTM is a unified threat management from Securepoint, Germany. A security vulnerability exists in Securepoint Unified Threat Management versions prior to 12.6.5 that stems from incorrectly handling OTP code...
CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)
The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2007-2768 advisory. - OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the...