PT-2024-38263

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A vulnerability was found in Keycloak where expired OTP codes are still usable when using FreeOTP with the default OTP token period of 30 seconds. Instead of expiring after 30 seconds, the...

Owners of 1-Time Passcode Theft Service Plead Guilty

Three men in the United Kingdom have pleaded guilty to operating otp.agency , a once popular online service that helped attackers intercept the one-time passcodes OTPs that many websites require as a second authentication factor in addition to passwords. Launched in November 2019, OTP Agency was ...

The vulnerability of the One-Time Password function in Securepoint Unified Threat Management (UTM) software allows a perpetrator to bypass the two-factor authentication process.

The vulnerability of the One-Time Password function in Securepoint Unified Threat Management UTM software-related microprogramming systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass two-factor authentication...

Craft CMS Allows TOTP Token To Stay Valid After Use

Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. Impact An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. A TOTP token can be used multiple times t...

CVE-2024-6637

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

CVE-2024-6637

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

PT-2024-37766 · WordPress · Woocommerce - Social Login

Name of the Vulnerable Software and Affected Versions: WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.7.3 Description: The issue is related to unauthenticated privilege escalation due to a lack of brute force controls on a weak one-time password. This allows...

Securepoint Unified Threat Management Security Vulnerability

Securepoint Unified Threat Management Securepoint UTM is a unified threat management from Securepoint, Germany. A security vulnerability exists in Securepoint Unified Threat Management versions prior to 12.6.5 that stems from incorrectly handling OTP code...

CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)

The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2007-2768 advisory. - OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the...

CVE-2024-3122

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CVE-2024-3123

CVE-2024-3123 affects CHANGING Mobile One Time Password. The vulnerability stems from the uploading function in a hidden page that does not properly filter file types, enabling an attacker with administrator privileges to upload and execute a malicious file to run system commands. According to th...

CVE-2024-3123 CHANGING Mobile One Time Password - Arbitrary File Upload

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands...

CVE-2024-3123 CHANGING Mobile One Time Password - Arbitrary File Upload

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands...

CVE-2024-3122 CHANGING Mobile One Time Password - Arbitrary File Reading

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CVE-2024-3122

CVE-2024-3122 affects CHANGING Mobile One Time Password. The issue: file-download parameter handling flaw allows reading arbitrary files on the system, exploitable by remote attackers with administrator privileges. Documented impact: read access to arbitrary files; CVSS base score 4.9 (MEDIUM) wi...

PT-2024-23861 · Unknown · Changing Mobile

Name of the Vulnerable Software and Affected Versions: CHANGING Mobile affected versions not specified Description: The issue concerns the Mobile One Time Password functionality, which does not properly filter parameters for the file download feature. This allows remote attackers with administrat...

CHANGING Mobile One Time Password Security Vulnerability

CHANGING Mobile One Time Password is a password management application from CHANGING Mobile, China. It is used to set one-time passwords for authentication or transactions. A security vulnerability exists in CHANGING Mobile One Time Password, which originates from an inability to properly filter...

PT-2024-23870 · Unknown · Changing Mobile One Time Password

Name of the Vulnerable Software and Affected Versions: CHANGING Mobile One Time Password affected versions not specified Description: The issue concerns a lack of proper file type filtering in the uploading function of a hidden page within CHANGING Mobile One Time Password. This allows remote...