GHSA-FXQ4-R6MR-9X64 CSRF Vuln can expose user's QRcode

Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

Authentication flaw

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

Hashicorp Terraform 授权问题漏洞

Hashicorp Terraform is an open source tool for provisioning and managing cloud infrastructure from HashiCorp Hashicorp, USA. A security vulnerability exists in HashiCorp Terraform that stems from a failure to enforce an organization-level setting that requires users within an organization to enab...

Terraform Enterprise Organization-Level MFA Requirement Was Not Enforced

Summary Terraform Enterprise did not enforce the organization-level setting to require all users within an organization to enable two-factor authentication. This vulnerability, CVE-2021-3153, was fixed in Terraform Enterprise v202103-1. Background Terraform Enterprise organizations are a shared...

How to enable Facebook’s hardware key authentication for iOS and Android

Since 2017 desktop users have had the opportunity to use physical security keys to log in to their Facebook accounts. Now iOS and Android users have the same option too. Physical security keys are a more secure option for two-factor authentication 2FA than SMS which is vulnerable to SIM swap...

OPENSUSE-SU-2021:0450-1 Security update for froxlor

This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 boo846355 - Upstream upgrade to version 0.10.22 boo846355 - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc boo1082318 Upstream upgrade to version...

OPENSUSE-SU-2021:0415-1 Security update for froxlor

This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 boo846355 - Upstream upgrade to version 0.10.22 boo846355 - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc boo1082318 Upstream upgrade to version...

Joomla Encryption Problem Vulnerability

Joomla is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla suffers from a cryptographic issue vulnerability that stems from not using the secure rand function during the generation of 2FA keys. No...

There is an unspecified vulnerability in Joomla

Joomla is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla suffers from a security vulnerability that stems from insufficient length for the use of 2FA secret sharing. No details of the vulnerability ar...

A $50,000 Bug Could've Allowed Hackers Access Any Microsoft Account

Microsoft has awarded an independent security researcher $50,000 as part of its bug bounty program for reporting a flaw that could have allowed a malicious actor to hijack users' accounts without their knowledge. Reported by Laxman Muthiyah, the vulnerability aims to brute-force the seven-digit...

Joomla 安全漏洞

Joomla is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla suffers from a security vulnerability that stems from insufficient length for the use of 2FA secret sharing. No details of the vulnerability ar...

Open Source Matters Joomla 安全特征问题漏洞

Joomla is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla suffers from a cryptographic issue vulnerability that stems from not using the secure rand function during the generation of 2FA keys. No...

Credential-Stuffing Attack Targets Regional Internet Registry

Regional internet registry RIPE NCC is warning of a credential-stuffing attack against its single sign-on service, RIPE NCC Access, and is encouraging users to implement two-factor authentication 2FA. Click to Register Located in Amsterdam, the Réseaux IP Européens Network Coordination Centre RIP...

Celeb SIM-Swap Crime Ring Stole $100M from U.S. Victims

A posse of alleged SIM-swapping cybercriminals has been rounded up across Europe by law-enforcement after the crooks finagled more than $100 million from U.S. celebrities and their families. Eight people in the U.K. were arrested in connection with the crime ring, in addition to individuals in...

Poor Password Security Led to Recent Water Treatment Facility Hack

New details have emerged about the remote computer intrusion at a Florida water treatment facility last Friday, highlighting a lack of adequate security measures needed to bulletproof critical infrastructure environments. The breach involved an unsuccessful attempt on the part of an adversary to...

Unspecified Vulnerability in Jetbrains JetBrains Hub

JetBrains Hub is a web-based application from the Czech company JetBrains. The program is capable of integrating multiple JetBrains team tools together. JetBrains Hub suffers from a security vulnerability that stems from the fact that an authenticated user can delete any other user's 2FA settings...

Microsoft Office 365 Attacks Sparked from Google Firebase

A phishing campaign bent on stealing Microsoft login credentials is using Google Firebase to bypass email security measures in Microsoft Office 365, researchers said. Researchers at Armorblox uncovered invoice-themed emails sent to at least 20,000 mailboxes that purport to share information about...