Microsoft365_devicePhish

Microsoft365devicePhish Abusando del flujo de autorización OAuth de Microsoft 365 para ataques de phishing Este es un script simple de prueba de concepto que permite a un atacante realizar un ataque de phishing contra el flujo de autorización OAuth de Microsoft 365. Usando esto, uno puede...

SYNwall

SYNwall Firewall de configuración cero IoT. SYNwall es un proyecto construido por ahora como un Módulo del Kernel de Linux, para implementar un firewall transparente y sin configuración/sin mantenimiento. Puede que quieras echar un vistazo al para un ejemplo de uso. Conceptos básicos Normalmente,...

ONe-TIME-ecb-oracle-attack-AES

ONe-TIME-ecb-oracle-attack-AES...

CVE-2026-87816

PasswordPusher before 2.11.1 is affected by a time-of-check-to-time-of-use (TOCTOU) race condition in its view-limit enforcement. An unauthenticated attacker can send concurrent requests to the show endpoint , accessing one-time secrets multiple times before the view count is incremented and the ...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

EUVD-2026-74842

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

Seecret.it

📦 Seecret.it — Secure sharing via one-time link Seecret.it is an online service for sharing passwords, documents or sensitive information via encrypted one-time links. Your data remains invisible, secure, and self-destructs after viewing. Ideal for IT teams, businesses, freelancers, and anyone...

DRUPAL-CONTRIB-2026-128

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can...

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...

GHSA-R3J6-GPJW-QFJR Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...

Astra Linux – Vulnerability in Firefox

If temporary “one-time” permissions, such as the ability to use the Camera, are granted to a document loaded using a file: URL, those permissions persist in that tab for all other documents loaded from the same file: URL. This is potentially dangerous if the local files come from different source...

CVE-2026-72689

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

EUVD-2026-55524

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-72584

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72584

The CVE-2026-72584 entry concerns fastschema up to v0.15.1, where a TOCTOU race in the verifyOTPSession function (pkg/auth/local.go) allows an unauthenticated remote attacker to bypass the OTP attempt limit in the account recovery flow. The root cause is non-atomic read/increment of the attempt c...

CVE-2026-72584

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

EUVD-2026-55222

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72584 fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-16619 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The CVE-2026-16619 entry affects the miniOrange 2FA WordPress plugin, specifically versions before 6.2.8. The vulnerability arises because the plugin does not properly limit second-factor verification attempts; it tracks attempts using a client-supplied identifier that is reissued on every login,...