TrueConf Server Brute Force

The vulnerability of the TrueConf Server software lies in the insufficient limitation on the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to carry out a brute-force attack remotely...

PT-2025-47152

Уязвимость программного обеспечения TrueConf Server, связана недостаточным ограничением попыток аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить атаку методом «грубой силы» brute force...

PT-2025-45883

Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990363 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4openowner leak when concurrent nfsd4open occur The action force umountumount -f wil...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989385)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989385 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for g...

Liferay Portal 7.4.0 < 7.4.3.120 Password Enumeration

Password enumeration vulnerability in Liferay Portal allows remote attackers to determine a user's password even if account lockout is enabled via brute force attack. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

CVE-2025-35021 Abilis CPX Fallback Shell Connection Relay

By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections...

Hack Exposes Kansas City’s Secret Police Misconduct List

A major breach of the Kansas City, Kansas, Police Department reveals, for the first time, a list of alleged officer misconduct including dishonesty, sexual harassment, excessive force, and false arrest...

Talos-Apache-Log-Oversight-Scanner

Talos-Apache-Log-Oversight-Scanner Overview The Talos-Ap...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early The creation of debugfs files is moved to a dedicated function, and it is ensured that these files are explicitly removed during vhcirelease, before the...

AllianceTM telemechanics Brute Force

The vulnerability of the AllianceTM telemechanics system is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor, operating remotely, to carry out an attack using brute-force methods...

CVE-2025-34249

Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...

EUVD-2025-37225

Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...

CVE-2025-61120

AG Life Logger Android App version v1.0.2.72 and before package name com.donki.healthy, developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force...

CVE-2025-62257

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers t...

LogicalDOC Community Edition security vulnerabilities

LogicalDOC Community Edition is a documentation system from LogicalDOC Italy. A security vulnerability exists in LogicalDOC Community Edition 9.2.1 and earlier versions, which stems from an improperly restricted authentication attempt in the file /login.jsp, which could lead to a remote brute-for...

CVE-2025-34249

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425...

CVE-2025-34249

...

CVE-2025-34249

...

CVE-2025-34249

CVE-2025-34249 relates to Nagios Fusion prior to 2024R2.1 and describes a brute-force bypass of the 2FA implementation due to inadequate rate limiting/account lockout, enabling repeated second-factor attempts and potential authentication compromise. Red Hat and ENISA references corroborate a 2FA ...