1301 matches found
CVE-2025-11084
A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period...
PT-2025-47047
Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.1 through 18.3.6 GitLab EE versions 18.4 through 18.4.4 GitLab EE versions 18.5 through 18.5.2 Description A security issue exists in GitLab EE that, under specific conditions, could allow an attacker to remove Duo...
CVE-2025-11084: Weak Authentication
A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period...
SUSE CVE-2025-64103
Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as...
CVE-2025-12485
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions :...
CVE-2025-12485
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions :...
CVE-2025-12485: Improper Privilege Management
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions :...
CVE-2025-64103 Zitadel Bypass Second Authentication Factor
Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as...
CVE-2025-64103
CVE-2025-64103 concerns Zitadel where, starting from versions 2.53.6, 2.54.3, and 2.55.0, MFA could be bypassed if the login policy did not explicitly require MFA, allowing sessions authenticated with a single factor to remain valid. An attacker could target a six‑digit TOTP code and bypass passw...
CVE-2025-64103: Use of Single-factor Authentication
Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as...
PT-2025-45701
Summary A vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified. Impact Zitadel provides an API for managing sessions, enabling custom login experiences in a dedicated UI or direct integration into applications. Session Tokens...
VulnCheck KEV: CVE-2023-5970
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass...
Multi-Factor Authentication in Spring Security 7
In 2013, it was proposed to add multi-factor authentication into Spring Security. That was the year that “selfie” was added to the English dictionary and “What Does the Fox Say?” was a viral YouTube hit. Needless to say, one of the biggest features in Spring Security 7 is a long time coming, and ...
October 2025 Security Advisory Ivanti Neurons for MDM
Summary Ivanti has released updates for Ivanti Neurons for MDM which addresses one medium and two high severity vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details Description | CVSS Score Severity | CVSS...
Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Steal Employee Salaries
A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts. "Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain...
EUVD-2020-26566
Malware in sbrugna...
EUVD-2017-17918
Malware in sbrugna...
EUVD-2019-17736
Malware in sbrugna...