Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current proftpd Vulnerability (SSA:2023-354-01)

The version of proftpd installed on the remote host is prior to 1.3.8b. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-354-01 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attacker...

FreeBSD : putty -- add protocol extension against 'Terrapin attack' (91955195-9ebb-11ee-bc14-a703705db3a6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91955195-9ebb-11ee-bc14-a703705db3a6 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other...

CVE-2023-48795

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

miniorange otp verification < 4.2.2 - Missing Authorization via dismiss_notice

Description The miniorange otp verification plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the dismissnotice function in versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with subscriber-level...

WordPress miniorange otp verification Plugin <= 4.2.1 is vulnerable to Broken Access Control

Software miniorange otp verification Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47776 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 60649c9bd1ee Credits Abdi Pranat...

CVE-2023-46754

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

Authorization

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

CVE-2023-46754

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

CVE-2023-46754

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

CVE-2023-46754

CVE-2023-46754 affects Obl.ong prior to 1.1.2. The issue is an authorization bypass in the admin panel caused by the email OTP feature accepting arbitrary numerical values. Affected component/file is the admin panel’s OTP handling; root cause is lax validation of OTP input, enabling bypass of acc...

CVE-2023-46754

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...

Registered OTP Device Removal Failure on native OTP management page

The following log can be found in "/tmp/aaad.debug" nsldapregisterencryptedotp 1-52: nsldapregisterencryptedotp: secret empty, nothing to delete for user...

OTP device test error "Failed to verify OTP from. Please ensure Citrix ADC is synced to NTP time"

OTP registered device test error "Failed to verify OTP. Please make sure Citrix ADC is synced to NTP time. "...

SUSE SLES15 Security Update : erlang (SUSE-SU-2023:3409-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3409-1 advisory. - Replaced the CVE-2022-37026 patch with the one released by the upstream to fix a regression in the previous one. bsc1205318 Tenable has...

Unable to enter multi-factor authentication with Citrix DaaS Remote PowerShell SDK

After installing and running the Virtual Apps and Desktops Remote PowerShell SDK, explicit authentication is required using the Get-XdAuthentication cmdlet. After entering the username and password, multi-factor authentication dialog is displayed,but the 6-digit OTP code input items are not...

Improper Certificate Validation

gitlab is vulnerable to Improper Certificate Validation. This vulnerability occurs due to security issue in relation to certificate validations for the fortinet OTP leading to an authentication issue...

WordPress SMS OTP Easy Login with Mocean Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software SMS OTP Easy Login with Mocean Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f36dc3803d0f Credits Rafie Muhammad...

WordPress Passwordless Login with OTP / SMS & Email – Account Kit Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Passwordless Login with OTP / SMS & Email – Account Kit Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f69eb28819b1...

CVE-2021-4425

The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verifyotplogintime function. This makes it possible for unauthenticated attackers to verify a one time login...

WordPress Plugin Defender Security 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...