Vendor archive

tinfoilsecurity CVEs

Beta · best-effort

3 CVEs tagged to vendor tinfoilsecurity — 0 Critical, 0 High, 3 Medium, 0 Low, 0 Unrated.

See this archive with more filters View vendor evidence profile Explore

CVE-2024-8796

Published Sep 17, 2024

Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. U…

CVSS 6.0 · Medium

Vendor/product tagsBeta · best-effort

CVE-2021-43177

Published Apr 11, 2022

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immedi…

CVSS 5.3 · Medium

Vendor/product tagsBeta · best-effort

CVE-2015-7225

Published Sep 6, 2017

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remo…

CVSS 5.3 · Medium

Vendor/product tagsBeta · best-effort

Showing 1-3 of 3 CVEsPage 1 of 1