CVE-2019-6481

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app." approach, related to a "Multifactor Auth Bypass, Full Disk Encryption Bypass" issue affecting the Affected Chrome Plugin component.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Mar/33Mailing List, Third Party Advisory
https://redcoded.com/cve/2018/03/10/CVE.htmlExploit, Third Party Advisory
https://redcoded.com/cve/2019/03/18/CVE.htmlExploit, Third Party Advisory
http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Mar/33Mailing List, Third Party Advisory
https://redcoded.com/cve/2018/03/10/CVE.htmlExploit, Third Party Advisory
https://redcoded.com/cve/2019/03/18/CVE.htmlExploit, Third Party Advisory

Timeline

Published: Mar 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-64855.9Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before CVE-2019-64868.2Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (C CVE-2019-64878.8TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote c CVE-2019-64887.8The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to u CVE-2019-64895.3Certain Lexmark CX, MX, X, XC, XM, XS, and 6500e devices before 2019-02-11 allow remote attackers to erase stored shortcuts.CVE-2019-64918.8RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection.CVE-2019-64925.5SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size CVE-2019-64935.5SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size CVE-2019-64946.5IMFForceDelete.sys in IObit Malware Fighter 6.2 allows a low privileged user to send IOCTL 0x8016E000 along with a user defined string to a CVE-2019-64968.8The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers CVE-2019-64979.8Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.CVE-2019-64988.8GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.