GHSA-5VFX-8W6M-H3V4 Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification

A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user mus...

Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification

A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user mus...

CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

CVE-2021-39874

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...

UBUNTU-CVE-2021-39874

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...

CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

UBUNTU-CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

PT-2021-23112 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl affected versions not specified Description: A malicious user can modify the contents of a confirmation token input during the two-factor authentication process to reference a cache value not associated with the login attempt. Thi...

PT-2021-22721 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.0 and later Description: The requirement to enforce 2-factor authentication 2FA is not honored when using git commands in the affected versions. Recommendations: For GitLab CE/EE versions 11.0 and later, consider...

PT-2021-22725 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.11.0 and later Description: The issue is related to missing authentication in GitLab CE/EE, which allows an attacker with access to a victim's session to disable two-factor authentication. Recommendations: For GitLab...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. An authorization issue vulnerability exists in GitLab EE, which can be exploit...

The FCC moves to curb SIM swap attacks

The Federal Communications Commission FCC is going to set new rules to curb the rising threat of SIM swapping, also known as SIMjacking. SIM swapping and the very similar port-out fraud is the unlawful use of someones personal information to steal their phone number and swap or transfer it to...

GitLab 安全特征问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security signature issue vulnerability exists in GitLab...

The Rise of One-Time Password Interception Bots

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords OTPs that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitor...

Gamers Beware: Malware Hunts Steam, Epic & EA Origin Accounts

There’s a new cybersecurity threat to gamers: An advanced trojan, dubbed BloodyStealer, has emerged on underground forums and is being used to steal gamer accounts on various platforms, including Steam, Epic Games Store and EA Origin. Demand for stolen gamer data throughout the underground market...

TangleBot Malware Reaches Deep into Android Device Functions

An Android malware called TangleBot has weaved its way onto the cyber-scene: One that researchers said can perform a bouquet of malicious actions, including stealing personal info and controlling apps and device functions. According to Cloudmark researchers, the newly discovered mobile malware is...

The vulnerability of the PAM-U2F authentication module stems from deficiencies in the authentication process. This allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the PAM-U2F authentication module is related to incorrect handling of NULL values. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

openSUSE 15 Security Update : nextcloud (openSUSE-SU-2021:1253-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1253-1 advisory. - Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud...