1291 matches found
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
Design/Logic Flaw
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
PYSEC-2022-303
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
PT-2022-26522 Ā· Unknown Ā· Django-Mfa2
Name of the Vulnerable Software and Affected Versions: django-mfa2 versions 2.5.0 through 2.5.1 django-mfa2 versions 2.6.0 through 2.6.0 Description: The issue allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated aft...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
CVE-2022-42731
CVE-2022-42731 affects django-mfa2, specifically the mfa/FIDO2.py component. The vulnerability is a replay attack where the device registration challenge is not invalidated after use, enabling an attacker to register another device for a user. Affected versions are before 2.5.1 and 2.6.x before 2...
django-mfa2 å®å Øę¼ę“
django-mfa2 is a Django application that handles MFA by Mohamed El-Kalioby Personal Developer. Supports TOTP, U2F, FIDO2 U2F Webauthn, email tokens and trusted devices. A security vulnerability exists in django-mfa2 versions prior to 2.5.1, and 2.6.x versions prior to 2.6.1, which stems from a...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage...
possbile griefing using replay attack
Lines of code Vulnerability details users who want to user redeem function has to set a value for amountIn this value cant be more than redeemBase , which is set in contract's constructor. the value of redeemBase will decrease in case of a successful call of redeem . while contract's solidity...
PT-2022-24558 Ā· Renault Ā· Renault Zoe
Name of the Vulnerable Software and Affected Versions: Renault ZOE version 2021 Description: The remote keyless system sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack. Recommendations: For Renault ZOE version 2021, consider...
Missing EIP-155 replay attack protection
Lines of code Vulnerability details Impact publishProject/addMember/escrow in Community and inviteContractor/updateProjectHash/addTasks/setComplete/changeOrder in Project use ecrecover for signed messages to check access. However, all signed messages that is used to check access do not include an...
Signature Replay Attack - Signatures are reusable
Lines of code Vulnerability details checkSignatureValidity performs a check to verify that the signer is the correct address. In the case of Community this is done on the following data: uint256 communityID, address builder, address lender, address agent, address project, uint256 repayAmount, byt...
Direct usage of ecrecover allows signature malleability
Lines of code Vulnerability details Impact The permit function of ERC20Permit calls the Solidity ecrecover function directly to verify the given signatures. However, the ecrecover EVM opcode allows malleable non-unique signatures and thus is susceptible to replay attacks. This can leads to permit...
CVE-2022-29593
relaycgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication or a valid signed/authorized request...
Rocky Linux 8 : thunderbird (RLSA-2022:5470)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5470 advisory. - The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evidence of memory corruption and ...
CVE-2022-33208
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software...
CVE-2022-2226
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...
Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this issue of when an OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, it will show the email's date. If the dat...
Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this issue of when an OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, it will show the email's date. If the dat...