Microsoft365_devicePhish

Microsoft365devicePhish Abuser du flux d'autorisation OAuth de Microsoft 365 pour une attaque de phishing Ceci est un script de preuve de concept simple qui permet à un attaquant de mener une attaque de phishing contre le flux d'autorisation OAuth de Microsoft 365. En l'utilisant, on peut se...

CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

iOSRestrictionBruteForce

Force brute du code de restriction iOS Aperçu Cette version de l'application est écrite en Python et est utilisée pour casser le code de restriction d'un iPhone/iPad. Elle exploite une faille dans les sauvegardes non chiffrées, permettant de découvrir le hachage et le sel. DÉPENDANCES Cela a été...

iPhoneRestrictionsPasscodeBF

iPhoneRestrictionsPasscodeBF Инструмент iPhoneRestrictionsPasscodeBF ищет резервную копию iPhone любой версии iOS на компьютере с Windows. Если такая копия существует, инструмент ищет в ней ограничительный пароль Restriction Passcode. Ограничительный пароль — это 4-значный код, используемый на...

ios_Restriction_PassCode_Crack---Python-version

Crack du code de restriction iOS - Version Python Aperçu Crack du code de restriction iOS , cette version de l'application est écrite en langage de programmation Python, utilisée pour casser le code de restriction de l'iPhone/iPad. iPhone/iPad 访问限制密码破解 Méthode identique à la version C Attaque par...

PoC-ubuntutouch-pin-privesc

ОБНОВЛЕНИЕ 09.09.2022 Я получил новую CVE для этой уязвимости: CVE-2022-40297. PoC: Повышение привилегий в Ubuntu Touch 16.04 — подбор кода доступа Ubuntu Touch позволяет «защитить» устройство 4-значным кодом доступа. Такой код был установлен на демонстрационном устройстве. Проблема в том, что то...

TeleKiller

. / |U| / \ \ | \ /\ |L| \ \ | /| | / | \ / / |T| | | | /| | | | | | | | | / / |R| | | | | | | | | | | | | | | |A| | | | | | | | | | | | | | \ \ |S| | | | | | | \ | | | /| /| /\ | / \ \ |E| | /| /| /| \ // / |/ / |C| / //|/ / '--8--' 8 O TeleKiller Un outil de détournement de session et de vol de...

lockphish

Lockphish v2.0 Lockphish it's the first tool 07/04/2020 for phishing attacks on the lock screen, designed to grab Windows credentials, Android PIN and iPhone Passcode using a https link. LockPhish Tutorial: https://www.kalilinux.in/2020/05/lockphish.html Author: The Linux Choice Who deleted his...

CVE-2024-50657

CVE-2024-50657:Contrôle d'accès incorrect sur l'APK Owncloud Un problème dans l'APK Android Owncloud v.4.4.1 permet à un attaquant physiquement proche d'élever ses privilèges via la classe PassCodeViewModel, plus précisément dans la méthode checkPassCodeIsValid. Type de vulnérabilité Contrôle...

CVE-2026-94112

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112

mayswind ezBookkeeping versions before 2.0.0 contain a TOTP replay attack vulnerability: the application fails to invalidate one-time passcodes after use. An attacker with stolen credentials can replay a captured TOTP code against multiple authorization attempts within the ~90-second acceptance w...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112: Authentication Bypass by Capture-replay

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

EUVD-2026-83460

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77771: Improper Authentication

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...