MTN Group: No rate limit in otp code sending

Summary: There is no rate limit in sendind otp code. Thus, attacker can use this vulnerability to bomb out the mobile inbox of the victim. Steps To Reproduce: Step 1. Open burp suite, and click on "Intercept is on " button from Proxy tab. Step 2. Launch browser and visit https://mtnonline.com/nim...

MTN Group: Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP code

I attached a PDF document to this report which explained the vulnerability in full details and I also attached a link to the POC video in the document. Impact Account take over of about any MTN user account...

Cross site request forgery (csrf)

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2019-7217

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2019-7217: Observable Discrepancy

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

GitLab: Bypassing password authentication of users that have 2FA enabled

Proof of Concept When a user has 2FA enabled, it's possible to sign in as that user without the need to know its password. To reproduce this attack, you need two users that both have 2FA enabled. For the sake of this PoC, lets call them Jane and John. Jane is the attacker and wants to get access ...