3331 matches found
CVE-2021-41177
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits as as "AnonRateThrottle" or "UserRateThrottle" was thus not...
Two-Factor Authentication not enforced for pages marked as public
None...
Ecommerce - Two Factor Authentication < 1.0.5 - Reflected Cross-Site Scripting
The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue v alert/XSS/ v 1.0.5: https://example.com/wp-admin/users.php?page=reset&action=resetedit&user="...
CVE-2021-41179: Missing Critical Step in Authentication
Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't...
PT-2021-23154
Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.13 Nextcloud Server versions prior to 21.0.5 Nextcloud Server versions prior to 22.2.0 Description Nextcloud is an open-source, self-hosted productivity platform. The Two-Factor Authentication wasn't...
Nextcloud 安全漏洞
Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Germany-based Nextcloud. Nextcloud has a security vulnerability that stems from an improperly designed or implemented problem in the code development process of the network system or...
Hackers Stealing Browser Cookies to Hijack High-Profile YouTube Accounts
Since at least late 2019, a network of hackers-for-hire have been hijacking the channels of YouTube creators, luring them with bogus collaboration opportunities to broadcast cryptocurrency scams or sell the accounts to the highest bidder. That's according to a new report published by Google's...
US Navy ship Facebook page hijacked to stream video games
The official Facebook page of the US Navy’s destroyer-class warship, USS Kidd, has been hijacked. According to Task & Purpose, who first reported on the incident, the account has done nothing but stream Age of Empires, an award-winning, history-based real-time strategy RTS video game wherein...
CVE-2021-41129
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...
Authentication flaw
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...
CVE-2021-41129
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a "confirmationtoken" input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...
CVE-2021-41129 Authentication bypass in Pterodactyl
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...
Pterodactyl 授权问题漏洞
Pterodactyl is an open source game server administration panel built using PHP, Nodejs and Go. Pterodactyl suffers from a security vulnerability that allows a malicious user to modify the content of the confirmationtoken input during the two-factor authentication process to refer to cached values...
CVE-2021-41129: Deserialization of Untrusted Data
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can...
Authentication Bypass
pterodactyl/panel is vulnerable to authentication bypass. The library does not properly verify the user-provided security token, allowing an attacker to bypass the two-factor authentication...
Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification
A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user mus...
GHSA-5VFX-8W6M-H3V4 Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification
A malicious user can modify the contents of a confirmationtoken input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user mus...
CVE-2021-39879
Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...
