The vulnerability of the RDP protocol implementation in Windows operating systems allows attackers to circumvent two-factor authentication mechanisms.

The vulnerability of the RDP protocol implementation in Windows operating systems is related to errors in processing RDP sessions based on NLA. Exploiting this vulnerability allows an attacker to circumvent two-factor authentication mechanisms by temporarily disconnecting via RDP and then...

CVE-2016-10826

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

Authentication flaw

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests SEC-93...

CVE-2016-10826

CVE-2016-10826 affects cPanel preceding 55.9999.141, where attackers can bypass two‑factor authentication via DNS clustering requests (SEC-93). The Red Hat/CNVD/NVD entries corroborate the vulnerability description and affected version. Remediation noted in public records is to upgrade to 55.9999...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2016-10831

CVE-2016-10831 affects cPanel before 55.9999.141. The issue is an authentication flaw where possessing another account does not trigger a two-factor authentication check (SEC-101). The vulnerability is described across multiple sources as an authorization/authentication issue in these versions. I...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

The Unsexy Threat to Election Security

Much has been written about the need to further secure our elections, from ensuring the integrity of voting machines to combating fake news. But according to a report quietly issued by a California grand jury this week, more attention needs to be paid to securing social media and email accounts...

Slack Initiates Mass Password Reset

Popular workspace collaboration platform Slack is in the middle of asking tens of thousands of users to reset their passwords after a security breach. The move is actually in response to new information that has come to light regarding a 2015 compromise, when hackers infiltrated Slack’s networks ...

This Flaw Could Have Allowed Hackers to Hack Any Instagram Account Within 10 Minutes

Watch out! Facebook-owned photo-sharing service has recently patched a critical vulnerability that could have allowed hackers to compromise any Instagram account without requiring any interaction from the targeted users. Instagram is growing quickly—and with the most popular social media network ...

MyBB JN-Jones MyBB-2FA plugin cross-site request forgery vulnerability

MyBB MyBulletinBoard is the MyBB team developed a set of PHP and MySQL development of free and Web-based forum software. The software is easy to use , support for multiple languages , scalable and so on.JN-Jones MyBB-2FA plugin is used in which a two-factor authentication plugin . A cross-site...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Cross site request forgery (csrf)

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

CVE-2019-12363

CVE-2019-12363 describes a CSRF vulnerability in the JN-Jones MyBB-2FA plugin for MyBB (up to 2014-11-05). An attacker can forge requests to an installed mybb2fa plugin to change its state via usercp.php?action=mybb2fa&do=deactivate (or ...&do=activate). This deactivates two-factor authentication...

CVE-2019-12363

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate or usercp.php?action=mybb2fa&do=activate. A deactivate operation lowers the...

Vulnerability to bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...

KeyIdentity LinOTP Access Control Error Vulnerability

KeyIdentity LinOTP is the German company KeyIdentity is an open source two-factor authentication solution. The solution supports different authentication protocols, token types and user repositories. An access control error vulnerability exists in KeyIdentity LinOTP versions prior to 2.10.5.3. Th...

Microsoft Adds 2FA-Protected "Personal Vault" Within OneDrive Cloud Storage

Microsoft has introduced a new password-protected folder within its OneDrive online file storage service that will allow you to keep your sensitive and important files protected and secured with an extra layer of authentication. Dubbed Personal Vault , the new OneDrive folder can only be accessed...

Threat Source newsletter (June 20, 2019)

Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. This week, we disclosed two vulnerabilities in KCodes’ NetUSB kernel module contains that could allow an attacker to inappropriatel...

Amazon Web Services IAM credential enumeration

Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all IAM credentials associated with the account This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'aws-sdk-iam...