PT-2023-28901 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 2.28.20 JumpServer versions prior to 3.7.1 Description: The verification code for resetting a user's password in JumpServer is vulnerable to brute-force attacks due to the absence of rate limiting. This allows for...

"Unable to process your request" error while registering for two-factor authentication

Registerfor two-factor authentication by using the following steps: ------- 1. Open a browser, navigate to the Workspace sign-in page, and select Don’t have a token? 2. Enter their user name in the domain\username format or their company email address and select Next. Citrix Cloud then sends the...

Mars: Response Manipulation lead to bypass verification code while making appointment at `█████████`

The vulnerability allowed bypassing the verification code when making an appointment at █████████. The response could be manipulated to change the verification check from false to true, enabling the appointment to be completed without the correct code...

No rate limit on "resend email feature" while enable or disable 2FA from /prefs/mfa endpoint

Description When a user is setting up 2FA , a verification code will be sent to the registered email . There is no rate limit on email triggering that will result in an email flood / does attack or will also increase the expenses on your mail server as an attacker can send 1 million emails throug...

No rate limit on email triggering during "resend email" action results in email flooding or a spam attack or a financial loss to the company itself

Description When a user is setting up 2FA , a verification code will be sent to the registered email . There is no rate limit on email triggering that will result in an email flood / does attack or will also increase the expenses on your mail server as an attacker can send 1 million emails throug...

Memory leaks in EdDSA DNSSEC verification code

...

Memory leak in ECDSA DNSSEC verification code

...

CVE-2022-24132

phpshe V1.8 is affected by a denial of service DoS attack in the registry's verification code, which can paralyze the target service...

CVE-2022-24132

phpshe V1.8 is affected by a denial of service DoS attack in the registry's verification code, which can paralyze the target service...

Code injection

phpshe V1.8 is affected by a denial of service DoS attack in the registry's verification code, which can paralyze the target service...

CVE-2022-24132

CVE-2022-24132 affects phpshe V1.8. The vulnerability is a denial of service in the registry verification/authentication path caused by mishandling a large number of message requests, potentially paralyzing the target service. Exploitation details are not provided beyond the DoS effect in the reg...

CVE-2022-25575

Multiple cross-site scripting XSS vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes...

CVE-2021-44626

A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloudconfig/routerpost/getregverifycode feature, which allows malicious users to execute arbitrary code on the system via a crafted post request...

CVE-2021-22565

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

CVE-2021-22565

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

Design/Logic Flaw

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

CVE-2021-22565 Insufficient Granularity of Access Control in GAEN Notification Server

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater...

CVE-2021-22565

CVE-2021-22565 affects the Google Exposure Notifications Verification Server. Root cause: insufficient granularity of access control in the verification-server component, enabling an attacker with permission to expire verification codes to invalidate codes that belong to another realm if the UUID...

PT-2021-15144 · Unknown · Exposure Notification Server

Name of the Vulnerable Software and Affected Versions: Exposure Notification server versions prior to V1.1.2 Description: An attacker could prematurely expire a verification code, making it unusable by the patient, and preventing the patient from uploading their TEKs to generate exposure...