141 matches found
Improper Authentication
com.liferay, com.liferay.multi.factor.authentication.timebased.otp.web is vulnerable to improper authentication. The vulnerability is due to the reuse of time-based one-time passwords TOTP within their validity period, which allows an attacker with access to a user’s TOTP to authenticate as that...
EUVD-2002-0440
Malware in sbrugna...
EUVD-2023-31050
Malicious code in bioql PyPI...
Liferay DXP Missing Critical Step in Authentication
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password TOTP to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user...
GHSA-4P5R-3JMM-652Q Liferay DXP Missing Critical Step in Authentication
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password TOTP to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user...
CVE-2025-43798
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password TOTP to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user...
CVE-2025-43798
CVE-2025-43798 affects Liferay DXP 2023.Q4.0, 2023.Q3.1–2023.Q3.4, and 7.4 GA up to update 92 (as well as 7.3 GA up to update 35). The issue is reuse of a time-based one-time password (TOTP) within its validity period, enabling an attacker who has a user’s TOTP to authenticate as that user. The c...
CVE-2025-43798
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password TOTP to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user...
CVE-2025-43798
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password TOTP to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user...
Liferay DXP 安全漏洞
Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP that stems from a one-time password that is reusable within its validity period, which could lead to an attacker exploiting a user's one-time password for...
GO-2025-3856 OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
SonicWall Confirms Patched Vulnerability Behind Recent VPN Attacks, Not a Zero-Day
SonicWall has revealed that the recent spike in activity targeting its Gen 7 and newer firewalls with SSL VPN enabled is related to an older, now-patched bug and password reuse. "We now have high confidence that the recent SSL VPN activity is not connected to a zero-day vulnerability," the compan...
SonicWall Confirms Patched Vulnerability Behind Recent VPN Attacks, Not a Zero-Day
SonicWall has revealed that the recent spike in activity targeting its Gen 7 and newer firewalls with SSL VPN enabled is related to an older, now-patched bug and password reuse. "We now have high confidence that the recent SSL VPN activity is not connected to a zero-day vulnerability," the compan...
CVE-2025-23168
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication 2FA using One-Time Passcodes OTP delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the O...
Remitly: Password Reset Allows Reusing Old Password -- [AUTH-3820]
A password reset functionality was identified that accepted the user's current password as the new password without validation. The system did not reject or warn against reusing the same password during the reset process...
activemq-artemis-operator: AMQ Broker Operator Starting Credentials Reuse
A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies...
ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse
A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies...
CVE-2025-4057
CVE-2025-4057 affects ActiveMQ Artemis AMQ Broker Operator. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies, enabling potential credential reuse of starting credentials. CVSS 3.1 base score 5.5 (Local, Low Privilege, No User Interaction; C...
Passwords in the age of AI: We need to find alternatives
For decades, passwords have been our default method for keeping online accounts safe. But in the age of artificial intelligence, this traditional security method is facing challenges it was never built to withstand. A team at Cybernews conducted a study of over 19 billion newly exposed passwords...
