1918 matches found
WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability
Sensitive Data Exposure via Log File vulnerability discovered by Snicco Patchstack Alliance in WordPress Plugin WP 2FA versions = 2.6.3...
Truist bank confirms data breach
On Wednesday June 12, 2024, a well-known dark web data broker and cybercriminal acting under the name "Sp1d3r" offered a significant amount of data allegedly stolen from Truist Bank for sale. Truist is a US bank holding company and operates 2,781 branches in 15 states and Washington DC. By assets...
Nextcloud Security Breach
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that stems from a second factor of 2FA that can be bypassed in some cases by successfully providing use...
UBUNTU-CVE-2024-28833
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms...
CVE-2024-28833 Missing brute-force protection for two factor authentication
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms...
CVE-2024-28833 Missing brute-force protection for two factor authentication
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms...
CVE-2024-28833
CVE-2024-28833 affects Checkmk 2.3 prior to 2.3.0p6, where excessive authentication attempts for two-factor authentication are not properly restricted, enabling brute-forcing of second factor mechanisms. The vulnerability is tied to the authentication flow and could impact confidentiality due to ...
CVE-2024-28833 Missing brute-force protection for two factor authentication
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms...
Bypassing 2FA with phishing and OTP bots
Introduction Two-factor authentication 2FA is a security feature we have come to expect as standard by 2024. Most of todays websites offer some form of it, and some of them wont even let you use their service until you enable 2FA. Individual countries have adopted laws that require certain types ...
PT-2024-22601 · Checkmk · Checkmk
Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.3 through 2.3.0p5 Description: The issue is related to improper restriction of excessive authentication attempts with two factor authentication methods, which facilitates brute-forcing of second factor mechanisms...
CVE-2022-45168
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backupcode endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes...
CVE-2022-45168
LIVEBOX Collaboration vDesk (v018 and prior) is affected by CVE-2022-45168. The issue allows bypassing two-factor authentication by generating or regenerating backup codes at the endpoints /login/backup_code and /api/v1/vdeskintegration/createbackupcodes before the TOTP check is performed. Root c...
LIVEBOX Collaboration vDesk Security Vulnerability
LIVEBOX Collaboration vDesk is an application from LIVEBOX, Inc. A security vulnerability exists in LIVEBOX Collaboration vDesk v018 and prior versions, which stems from the application allowing a user to generate or regenerate backup code prior to checking TOTP, where a two-factor authentication...
Checkmk Security Vulnerabilities
Checkmk is an editor. A security vulnerability exists in versions prior to Checkmk 2.3.0p6 that stems from improperly limiting excessive authentication attempts for the two-factor authentication method, which can lead to brute force cracking...
Advance Auto Parts customer data posted for sale
A cybercriminal using the handle Sp1d3r is offering to sell 3 TB of data taken from Advance Auto Parts, Inc. Advance Auto Parts is a US automotive aftermarket parts provider that serves both professional installers and do it yourself customers. Allegedly the customer data includes: Names Email...
Password hash exposed in CraftCMS two factor authentication plugin
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...
Improper Authentication in CraftCMS two factor authentication plugin
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...
GHSA-96QM-HWHP-2RM8 Improper Authentication in CraftCMS two factor authentication plugin
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period...
GHSA-3P4X-GRPM-XW58 Password hash exposed in CraftCMS two factor authentication plugin
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP...
