Brute Force Attack

devise-two-factor is vulnerable to Brute Force Attack. The vulnerability is due to a lack of attempt restriction of login attempts in Devise-Two-Factor. This issue, when combined with the inherent entropy limitations of the Time-based One-Time Password TOTP algorithm, This allows an attacker to...

Devise-Two-Factor vulnerable to brute force attacks

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. Impact If a...

Design/Logic Flaw

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks...

CVE-2024-0227

Devise-Two-Factor is vulnerable to brute-force attacks due to no throttling of login attempts by default, allowing an attacker to test possible TOTP codes if username/password are compromised. Documents from RubySec and GitHub advisories describe an attacker bypassing 2FA by brute-forcing TOTP, w...

CVE-2023-6520

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the sendbackupcodesemail function. This makes it possible for unauthenticated...

CVE-2023-6506

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...

Cross site request forgery (csrf)

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the sendbackupcodesemail function. This makes it possible for unauthenticated...

Design/Logic Flaw

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...

CVE-2023-6506 WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...

CVE-2023-6520

CVE-2023-6520 covers the WP 2FA – Two-factor authentication for WordPress plugin. The vulnerability exists in versions

Mandiant's X Account Was Hacked Using Brute-Force Attack

The compromise of Mandiant's X formerly Twitter account last week was likely the result of a "brute-force password attack," attributing the hack to a drainer-as-a-service DaaS group. "Normally, two-factor authentication would have mitigated this, but due to some team transitions and a change in X...

Number withdrawn

Devise-Two-Factor is a minimalist extension to Devise. It is used to provide support for two-factor authentication through the TOTP scheme. This CVE number has been withdrawn...

PT-2024-15397 · Unknown · Devise-Two-Factor

Name of the Vulnerable Software and Affected Versions: Devise-Two-Factor affected versions not specified Description: The issue concerns Devise-Two-Factor not throttling or restricting login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP...

WordPress Plugin WP 2FA Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Plugin WP 2FA Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-15283 · Undefined · Undefined

🚨 ZeroDay Alert in Ivanti VPN! CVE-2023-846805 & CVE-2024-21887 let attackers bypass 2FA & run code. 🛡️ Volexity links this to UTA0178, a suspected state-level actor. Urgent patching needed! 💻🔐 CyberSecurity IvantiVPN InfoSec...

The vulnerability of corporate managers’ passwords in Passwork, related to deficiencies in authentication procedures, allows attackers to bypass two-factor authentication (2FA).

The vulnerability of corporate managers’ passwords in Passwork is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass two-factor authentication by obtaining a one-time six-digit code...

GitLab 7.11.0 < 14.1.7 (CVE-2021-39879)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication CVE-2021-39879 Note that Nessus ha...

CVE-2022-44589

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor...

CVE-2022-44589

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor...