CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

PT-2024-37766 · WordPress · Woocommerce - Social Login

Name of the Vulnerable Software and Affected Versions: WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.7.3 Description: The issue is related to unauthenticated privilege escalation due to a lack of brute force controls on a weak one-time password. This allows...

Securepoint Unified Threat Management Security Vulnerability

Securepoint Unified Threat Management Securepoint UTM is a unified threat management from Securepoint, Germany. A security vulnerability exists in Securepoint Unified Threat Management versions prior to 12.6.5 that stems from incorrectly handling OTP code...

CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)

The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2007-2768 advisory. - OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the...

CVE-2024-3122

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CVE-2024-3123 CHANGING Mobile One Time Password - Arbitrary File Upload

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands...

CVE-2024-3123 CHANGING Mobile One Time Password - Arbitrary File Upload

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands...

CVE-2024-3123

CVE-2024-3123 affects CHANGING Mobile One Time Password. The vulnerability stems from the uploading function in a hidden page that does not properly filter file types, enabling an attacker with administrator privileges to upload and execute a malicious file to run system commands. According to th...

CVE-2024-3122

CVE-2024-3122 affects CHANGING Mobile One Time Password. The issue: file-download parameter handling flaw allows reading arbitrary files on the system, exploitable by remote attackers with administrator privileges. Documented impact: read access to arbitrary files; CVSS base score 4.9 (MEDIUM) wi...

CVE-2024-3122 CHANGING Mobile One Time Password - Arbitrary File Reading

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CHANGING Mobile One Time Password Security Vulnerability

CHANGING Mobile One Time Password is a password management application from CHANGING Mobile, China. It is used to set one-time passwords for authentication or transactions. A security vulnerability exists in CHANGING Mobile One Time Password, which originates from an inability to properly filter...

PT-2024-23861 · Unknown · Changing Mobile

Name of the Vulnerable Software and Affected Versions: CHANGING Mobile affected versions not specified Description: The issue concerns the Mobile One Time Password functionality, which does not properly filter parameters for the file download feature. This allows remote attackers with administrat...

PT-2024-23870 · Unknown · Changing Mobile One Time Password

Name of the Vulnerable Software and Affected Versions: CHANGING Mobile One Time Password affected versions not specified Description: The issue concerns a lack of proper file type filtering in the uploading function of a hidden page within CHANGING Mobile One Time Password. This allows remote...

CVE-2024-23580 HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)

HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords OTPs. This could allow an attacker with access to the database to recover some or all encrypted values...

PT-2024-19947 · Hcl · Hcl Dryice Optibot Reset Station

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE Optibot Reset Station affected versions not specified Description: The issue concerns insecure encryption of One-Time Passwords OTPs in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to t...

HCL Technologies HCL DRYiCE Optibot Reset Station 安全漏洞

HCL Technologies HCL DRYiCE Lucy is an AI-powered virtual assistant from HCL Technologies, USA. A security vulnerability exists in the HCL Technologies HCL DRYiCE Optibot Reset Station that stems from being affected by insecure encryption with a one-time password OTP...

PT-2024-18728 · Samsung · Samsung Mobile Devices

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Devices affected versions not specified Description: A vulnerability allows local attackers to reconfigure OTP, enabling them to transit into RMA mode, which disables security features. This attack requires additional privilege...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL in Switzerland. A security vulnerability exists in ZITADEL versions prior to 2.50.0 that stems from an improper application locking...