CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

Design/Logic Flaw

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

CVE-2021-43177

CVE-2021-43177 affects Devise-Two-Factor prior to 4.0.2. The vulnerability results from an incomplete fix for CVE-2015-7225, allowing an attacker to reuse a One-Time-Password (OTP) for the immediately trailing interval. The issue is documented across multiple sources (e.g., NVD, GN, Debian, Ubunt...

GHSA-JM35-H8Q2-73MP Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

WordPress Passwordless Login with OTP / SMS & Email – Account Kit plugin <= 1.2.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Passwordless Login with OTP / SMS & Email – Account Kit plugin versions = 1.2.3. Solution No patched version available...

WordPress Passwordless Login with OTP / SMS & Email – Account Kit plugin <= 1.2.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Passwordless Login with OTP / SMS & Email – Account Kit plugin versions = 1.2.3. Solution No patched version available...

wasmcloud-otp 安全漏洞

wasmcloud-otp is a wasmCloud server process that securely hosts and provides scheduling for participants and capability providers. wasmcloud-otp suffers from a security vulnerability that stems from the fact that in versions prior to 0.52.2, participants can bypass capability authorization. No...

Mattermost: Bypass Email Verification in Customer Portal

Hi team hope you doing well : i found a vulnerability OTP Bypass on https://portal.test.cloud.mattermost.com . Summery : I was able to use the otp that was sent to victim email and i used it in the attacker's email verify .when i tried this issue first time the server log me out , and second time...

panorama Mobile One Time Password SQL Injection Vulnerability

panorama Mobile One Time Password MOTP is a mobile dynamic password system of China Panorama. With a solid two-factor authentication mechanism, through the OTP dynamic password constantly changing characteristics, effectively solve the problem of account, password theft, to ensure the security of...

S-Pankki: Email/OTP verification bypass leads to Pre-Account Takeover.

Handled in https://jira.sok.fi/browse/VOIK-6267...

Input validation

Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account...

CVE-2020-27416

Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account...

CVE-2020-27416

The CVE-2020-27416 entry describes a vulnerability in the Mahavitaran Android application (7.50 and earlier) where improper OTP validation enables account takeover and remote control of a user’s account. The issue is rooted in OTP handling/authentication flaws that allow an attacker to compromise...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

Design/Logic Flaw

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

CVE-2021-41716

The CVE-2021-41716 entry applies to the Mahavitara Android Application (Maharashtra State Electricity Board) versions 8.20 and earlier. The vulnerability is an OTP fixation flaw in the password reset function that enables remote account takeover. Connected sources corroborate the issue and its im...

FortiAuthenticator - "Mandatory password and OTP" setting not enforcing OTP on unimported remote users

An incorrect implementation of authentication algorithm vulnerability CWE-303 in FortiAuthenticator may allow an user whose LDAP account is unimported to bypass the second factor of authentication via a RADIUS login portal...