CVE-2024-48942: Improper Control of Interaction Frequency

The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...

CVE-2023-22958

The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter...

Syracom 输入验证错误漏洞

Syracom is a solution for individual developers. A security vulnerability exists in Syracom versions prior to 3.1.1.0, which stems from a vulnerability that allows spoofing of 2FA PIN authentication via the plugins/servlet/twofactor/public/pinvalidation target parameter...

CVE-2023-22958: URL Redirection to Untrusted Site

The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter...