Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not enforcing MFA on plugin endpoints, allowing an authenticated attacker to bypass MFA protections via API requests...

Fedora 40 : fluent-bit (2025-b2bdcfedac)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b2bdcfedac advisory. Update to 3.2.8 - Closes rhbz2137000 rhbz2340164 rhbz2300673 Tenable has extracted the preceding description block directly from the Fedora security advisory...

USN-7354-1 djoser vulnerability

Diego Cebrián discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly use this to bypass authentication checks, such as two-factor authentication, to gain unintended access...

USN-7354-1: djoser vulnerability

Diego Cebrián discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly use this to bypass authentication checks, such as two-factor authentication, to gain unintended access...

CVE-2025-29996

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

FBI and CISA Urge Enabling 2FA to Counter Medusa Ransomware

FBI and CISA warn of Medusa ransomware attacks impacting critical infrastructure. Learn about Medusa's tactics, prevention tips, and…...

CVE-2025-29996

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

CVE-2025-29996 Authentication Bypass Vulnerability in CAP back office application

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

CVE-2025-29996 Authentication Bypass Vulnerability in CAP back office application

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

CVE-2025-29996

CVE-2025-29996 affects the CAP back office application. The issue is an improper implementation of the OTP verification in the API-based login, allowing a remote attacker with valid credentials to manipulate API requests to bypass 2FA for other user accounts. The core vulnerability is in the OTP/...

Rising Technosoft CAP back office application 安全漏洞

Rising Technosoft CAP back office application is a back office application from Rising Technosoft India. A security vulnerability exists in the Rising Technosoft CAP back office application, which stems from a poor implementation of the OTP authentication mechanism in the API login, allowing remo...

WordPress Really Simple SSL 9.0.0 Authentication Bypass

WordPress Really Simple SSL plugin version 9.0.0 proof of concept 2FA bypass that allows the uploading of a malicious plugin. ============================================================================================================================================= | Title : WordPress Really...

CVE-2025-29996: Authentication Bypass Using an Alternate Path or Channel

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

CVE-2024-10924 CVE-2024-10924 - Authentication Bypass in Reall...

CVE-2025-25450

An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint...

Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist

SafeWallet has revealed that the cybersecurity incident that led to the Bybit $1.5 billion crypto heist is a "highly sophisticated, state-sponsored attack," stating the North Korean threat actors behind the hack took steps to erase traces of the malicious activity in an effort to hamper...

Gradio UI Detection

The remote web server hosts Gradio UI web application %NASLMINLEVEL 80900 Tenable, Inc. include'compat.inc'; if description scriptid232290; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/03/18"; scriptnameenglish:"Gradio UI Detection";...

CVE-2025-25450

An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint...

CVE-2025-25450

An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint...

Android botnet BadBox largely disrupted

Removing 24 malicious apps from the Google Play store and silencing some servers almost halved a botnet known as BadBox. The BadBox botnet focuses on Android devices, but not just phones. It also affects other devices like TV streaming boxes, tablets, and smart TVs. The German BSI Federal Office...