CVE-2021-32033

CVE-2021-32033 affects Protectimus SLIM NFC 70 with firmware 10.01. The root cause is that the device’s internal real-time clock (RTC) can be set independently from the TOTP seed, without authentication, allowing an attacker with short-term physical access to set the clock forward, generate futur...

OpenSSH < 4.7 Improper Authentication Vulnerabilities

OpenSSH is prone to multiple improper authentication vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Finding the Cracks in the Wall - How Modern Scams Bypass MFA

In my previous blog, I discussed the important role multi-factor authentication MFA plays in further securing access to enterprise and consumer services. We also established the fact that although MFA increases authentication security and decreases the risk of account takeover, MFA can, and is,...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

Tiny Tiny RSS 安全漏洞

Tiny Tiny RSStt-rss,tt-rss is an open source based browser-based news feed reader and aggregator. Tiny Tiny RSS before 2021-03-12 A security vulnerability exists that allows an attacker to log in via OTP code without a valid password...

UBUNTU-CVE-2021-3144

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

CVE-2020-13860

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generates a predictable six-digit password...

CVE-2020-13860

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generates a predictable six-digit password...

Mofi Network MOFI4500-4GXeLTE 安全特征问题漏洞

The Mofi Network MOFI4500-4GXeLTE is a wireless router from Mofi Network. A security vulnerability exists in the Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices, which can be exploited by an attacker to know the generation algorithm via firmware reverse, and directly calculate the one-time passwo...

Vault SSH Helper Validated IP Addresses Incorrectly

Summary vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host’s network interface was located, rather than the specific IP address assigned to that interface. Assigned CVE-2020-24359 and fixed in 0.1.7. Background...

CVE-2020-13353

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above...

GovRAT 2.0 - FUD unknown RAT with special functions

This RAT was written by me and cannot be blocked. FUD tested with the strictest firewall policies. You are buying the source code + digital certificate to sign your files. I can also host the C&C for you for extra Functions: Access C&C with any browser. Compile C&C for Linux OR Windows. VALID...

OpenSSH when using OPIE (One-Time Passwords in Everything) for PAM allows remote attackers to determine the existence of certain user accounts which displays a different response if the user account exists and is configured to use one-time passwords (OTP) a similar issue to CVE-2007-2243.

...

Android 11 — 5 New Security and Privacy Features You Need to Know

After a long wait and months of beta testing, Google last week finally released Android 11, the latest version of the Android mobile operating system—with features offering billions of its users more control over their data security and privacy. Android security is always a hot topic and almost...

Android 11 — 5 New Security and Privacy Features You Need to Know

After a long wait and months of beta testing, Google last week finally released Android 11, the latest version of the Android mobile operating system—with features offering billions of its users more control over their data security and privacy. Android security is always a hot topic and almost...

Mofi Network MOFI4500-4GXeLTE Security Feature Issue Vulnerability

The Mofi Network MOFI4500-4GXeLTE is a wireless router from Mofi Network. A security vulnerability exists in the Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices, which can be exploited by an attacker to know the generation algorithm via firmware reverse, and directly calculate the one-time passwo...

PT-2020-15705 · Hashicorp · Vault-Ssh-Helper

Name of the Vulnerable Software and Affected Versions: HashiCorp vault-ssh-helper versions 0.1.6 and earlier Description: The issue arises from improper input validation in the vault-ssh-helper, where it incorrectly accepted Vault-issued SSH OTPs for the subnet of a host's network interface rathe...

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

Smule: No Rate Limiting On Phone Number Login Leads to Login Bypass

Hey Team, Introduction: A rate limiting algorithm is used to check if the user session has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame. Description: I was able to Bypass Authentication of any user by enumerating th...

Any Indian DigiLocker Account Could've Been Accessed Without Password

The Indian Government said it has addressed a critical vulnerability in its secure document wallet service Digilocker that could have potentially let a remote attacker bypass mobile one-time passwords OTP and sign in as other users. Discovered separately by two independent bug bounty researchers,...