Threat actors thrive in chaos

Welcome to this week's edition of the Threat Source newsletter. If there's one thing that threat actors love, it's chaos. Headlines in the news that provoke an emotional response make excellent phishing lures because the intense feelings invoked by a provocative subject line cause our critical...

Password Spray Attacks Taking Advantage of Lax MFA

In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...

Password Spray Attacks Taking Advantage of Lax MFA

In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...

CVE-2024-55210

An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...

CVE-2024-55210

An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...

TOTVS 安全漏洞

TOTVS is a complete human resource management solution from the Brazilian company TOTVS. A security vulnerability exists in TOTVS version 12.1.2310, which stems from vulnerability to a specially crafted websocket message bypassing multi-factor authentication attack...

PT-2025-15840 · Totvs · Totvs Framework

Name of the Vulnerable Software and Affected Versions: TOTVS Framework Linha Protheus version 12.1.2310 Description: An issue in the software allows attackers to bypass multi-factor authentication MFA via a crafted websocket message. Recommendations: For version 12.1.2310, consider disabling...

CVE-2024-55210

An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...

CVE-2024-55210

A security vulnerability exists in TOTVS Framework (Linha Protheus) version 12.1.2310 that allows attackers to bypass multi-factor authentication (MFA) . The root cause is an issue where a crafted websocket message can be used to circumvent the authentication process. This vulnerability could lea...

CVE-2024-55210

An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...

Joomla CMS Multi-Factor Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

GHSA-6423-85CC-8GF6 Joomla CMS Multi-Factor Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227

The Joomla CMS is vulnerable to a Multi-Factor Authentication (MFA) bypass due to insufficient state checks in the MultiFactorAuthenticationHandler::needsMultiFactorAuthenticationRedirection() method. The vulnerability occurs because this method calls isMultiFactorAuthenticationPage() without the...

CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

Joomla! 授权问题漏洞

Joomla! is a free, open source content management system open-sourced by Joomla! An authorization issue vulnerability exists in Joomla! that stems from an insufficient status check that results in bypassing two-factor authentication checks...

PT-2025-15469 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla versions up to 4.4.12 and 5.2.5 Description: The issue is related to insufficient state checks, which create a vector allowing attackers to bypass 2FA checks. This leads to improper authentication. Recommendations: For Joomla versions ...

CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...