Yubikey One Time Password Validation Server vulnerabilities

Product

Yubikey One Time Password Validation Server

by Yubico · last CVE Mar 5, 2020

CVEs

On KEV

8.6

Max CVSS

New 30D

Severity mix

Critical 0High 2Medium 0Low 0

Severity

Exploitation

Watch

Add Yubikey One Time Password Validation Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-10185	8.6	2%	Mar 5	The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP Affected: before 2.40
CVE-2020-10184	7.5	2%	Mar 5	The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL… Affected: before 2.40