cPanel Authorization Issues Vulnerability (CNVD-2019-29619)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 55.9999.141. An attacker could exploit the vulnerability to...

CVE-2016-10826

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

Authentication flaw

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

CVE-2016-10826

CVE-2016-10826 affects cPanel preceding 55.9999.141, where attackers can bypass two‑factor authentication via DNS clustering requests (SEC-93). The Red Hat/CNVD/NVD entries corroborate the vulnerability description and affected version. Remediation noted in public records is to upgrade to 55.9999...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

Authentication flaw

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10831

CVE-2016-10831 affects cPanel before 55.9999.141. The issue is an authentication flaw where possessing another account does not trigger a two-factor authentication check (SEC-101). The vulnerability is described across multiple sources as an authorization/authentication issue in these versions. I...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

The Unsexy Threat to Election Security

Much has been written about the need to further secure our elections, from ensuring the integrity of voting machines to combating fake news. But according to a report quietly issued by a California grand jury this week, more attention needs to be paid to securing social media and email accounts...

Slack Initiates Mass Password Reset

Popular workspace collaboration platform Slack is in the middle of asking tens of thousands of users to reset their passwords after a security breach. The move is actually in response to new information that has come to light regarding a 2015 compromise, when hackers infiltrated Slack’s networks ...

This Flaw Could Have Allowed Hackers to Hack Any Instagram Account Within 10 Minutes

Watch out! Facebook-owned photo-sharing service has recently patched a critical vulnerability that could have allowed hackers to compromise any Instagram account without requiring any interaction from the targeted users. Instagram is growing quickly—and with the most popular social media network ...

MyBB JN-Jones MyBB-2FA plugin cross-site request forgery vulnerability

MyBB MyBulletinBoard is the MyBB team developed a set of PHP and MySQL development of free and Web-based forum software. The software is easy to use , support for multiple languages , scalable and so on.JN-Jones MyBB-2FA plugin is used in which a two-factor authentication plugin . A cross-site...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Cross site request forgery (csrf)

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

CVE-2019-12363

CVE-2019-12363 describes a CSRF vulnerability in the JN-Jones MyBB-2FA plugin for MyBB (up to 2014-11-05). An attacker can forge requests to an installed mybb2fa plugin to change its state via usercp.php?action=mybb2fa&do=deactivate (or ...&do=activate). This deactivates two-factor authentication...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Vulnerability to bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...

Vulnerability to bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...

KeyIdentity LinOTP Access Control Error Vulnerability

KeyIdentity LinOTP is the German company KeyIdentity is an open source two-factor authentication solution. The solution supports different authentication protocols, token types and user repositories. An access control error vulnerability exists in KeyIdentity LinOTP versions prior to 2.10.5.3. Th...