1008 matches found
JVN#74534998: Android App "IIJ SmartKey" vulnerable to information disclosure
Android App "IIJ SmartKey" provided by Internet Initiative Japan Inc. contains an information disclosure vulnerability CWE-200. Impact Under certain conditions, an attacker may obtain a one-time password issued by the product. Solution Update the application Update the application to the latest...
Credential stuffers take aim at Final Fantasy XIV players
Square Enix, the company behind video games like Final Fantasy XIV, reports that a third party is attempting to gain access to its Account Management System. How is this happening, and what are the risks? More importantly, what do you need to do to ensure your accounts are safe from harm?...
PT-2022-23836 · Plextrac · Plextrac
Name of the Vulnerable Software and Affected Versions: PlexTrac platform versions prior to 1.17.0 Description: The issue allows an unauthenticated remote attacker with a valid username and password to bruteforce their way past MFA protections and login as the targeted user due to the lack of...
CVE-2022-34771
Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the...
GTAB Software Tabit 安全漏洞
GTAB Software Tabit is a full-featured program from GTAB Software for creating, playing and printing fingerstyle music for guitar, bass or banjo. A security vulnerability exists in GTAB Software Tabit that stems from its system password being a 4-digit OTP.An attacker could resend the OTP and...
PT-2022-22322 · Tabit · Tabit
Name of the Vulnerable Software and Affected Versions: Tabit affected versions not specified Description: The issue allows an adversary to send messages on Tabit's behalf to anyone registered on the system. The resend OTP API receives parameters such as phone number and CustomMessage, which can b...
GTAB Software Tabit 安全漏洞
GTAB Software Tabit is a full-featured program from GTAB Software for creating, playing, and printing fingerstyle scores for guitar, bass, or banjo. GTAB Software Tabit suffers from a security vulnerability that stems from its retransmission OTP API that allows an attacker to craft malicious...
CVE-2022-34771
Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the...
CVE-2022-34772
Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting...
SAP Authenticator 信息泄露漏洞
SAP Authenticator is a mobile application from SAP Germany that generates passwords for systems that require one-time password authentication. SAP Authenticator suffers from an information disclosure vulnerability. No information about this vulnerability is available at this time, so please stay...
GHSA-6X93-H9G3-9PHR otp-generator before v3.0.0 insecurely generates random one-time passwords
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
Design/Logic Flaw
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451 Insecure Randomness
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2022-2192
Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions...
HYPR Server 安全漏洞
HYPR and HYPR Server are both products of HYPR, Inc.HYPR is a security application that implements password-less security.HYPR Server is a server. A security vulnerability exists in HYPR Server versions 6.10 through 6.15.1, which stems from a forced browsing vulnerability that allows a remote...
Toll fraud malware: How an Android application can drain your wallet
Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...
Toll fraud malware: How an Android application can drain your wallet
Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...