Google Warns of Scattered Spider Attacks Targeting IT Support Teams at U.S. Insurance Firms

The notorious cybercrime group known as Scattered Spider aka UNC3944 that recently targeted various U.K. and U.S. retailers has begun to target major insurance companies, according to Google Threat Intelligence Group GTIG. "Google Threat Intelligence Group is now aware of multiple intrusions in t...

PT-2025-25651

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Application Delivery Controller versions prior to 12.1-55.328 Citrix NetScaler Application Delivery Controller versions prior to 13.1-37.235 Citrix NetScaler Application Delivery Controller versions prior to 13.1-58.32 Citrix...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force via the second factor verification process. An attacker can bypass authentication controls by automating OTP guessing attempts. Remediation Upgrade Weblate to version 5.12.1 or higher. References - GitHub Commit - GitHub PR ...

CVE-2025-47951

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

CVE-2025-47951 Weblate lacks rate limiting when verifying second factor

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

CVE-2025-47951

Weblate (localization tool) prior to version 5.12 lacked rate limiting on the second-factor verification endpoint. This allowed an attacker with valid credentials to automate OTP guessing, potentially evading authentication controls. The vulnerability has been fixed in Weblate 5.12 (and patched i...

CVE-2025-47951 Weblate lacks rate limiting when verifying second factor

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

CVE-2025-47951 Weblate lacks rate limiting when verifying second factor

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

GHSA-57JG-M997-CX3Q Weblate lacks rate limiting when verifying second factor

Impact The verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. Patches This issue has been addressed in Weblate 5.12 via...

Weblate lacks rate limiting when verifying second factor

Impact The verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. Patches This issue has been addressed in Weblate 5.12 via...

Astra Linux – Vulnerability in coreutils

The vulnerability of the factor utility in the GNU Core Utilities suite is related to its dependence on behaviors that are undefined for each type of implementation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-25574

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.12 Description The verification of the second factor was not subject to rate limiting, allowing an attacker with valid credentials to automate OTP guessing via the second factor endpoint. Recommendations For version...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate versions prior to 5.12, which stems from a failure to rate-limit second-factor authentication and could lead to OTP guessing...

CVE-2025-47951: Improper Restriction of Excessive Authentication Attempts

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

GO-2025-3570 SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver

SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

Everyone's on the cyber target list

Welcome to this week's edition of the Threat Source newsletter. I've discovered that being a rent guarantor for someone is an involved experience. While I'm glad that I can help out a loved one secure a better rental property, the process of verifying my identity and ability to cover any missed...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

CVE-2025-5382

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA...

CVE-2025-5382

The Devolutions Server (version 2025.1.7.0 and earlier) is vulnerable to an improper access control flaw within the Multi-Factor Authentication (MFA) feature. This vulnerability allows a user possessing user management permissions to unauthorizedly remove or change the MFA settings of administrat...