1382 matches found
GHSA-J5JW-M2PH-3JJF Mattermost Missing Authentication for Critical Function
Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...
Mattermost Missing Authentication for Critical Function
Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...
The Evolution of Zero Trust Architecture (ZTA) from Concept to Implementation
Zero Trust Architecture ZTA is one of the paradigm changes in cybersecurity, from the traditional perimeter-based model to perimeterless. This article studies the core concepts of ZTA, its beginning, a few use cases and future trends. Emphasising the always verify and least privilege access, some...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 10.5.1 and earlier and 9.11.9 and earlier, which stems from an insufficient MFA check and could lead to unauthorized MFA operations...
Russia’s Storm-2372 Hits Orgs with MFA Bypass via Device Code Phishing
Russian APT group Storm-2372 employs device code phishing to bypass Multi-Factor Authentication MFA. Targets include government, technology, finance,…...
Palo Alto Networks Warns of Brute-Force Attempts Targeting PAN-OS GlobalProtect Gateways
Palo Alto Networks has revealed that it's observing brute-force login attempts against PAN-OS GlobalProtect gateways, days after threat hunters warned of a surge in suspicious login scanning activity targeting its appliances. "Our teams are observing evidence of activity consistent with...
CVE-2024-55210
An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...
Threat actors thrive in chaos
Welcome to this week's edition of the Threat Source newsletter. If there's one thing that threat actors love, it's chaos. Headlines in the news that provoke an emotional response make excellent phishing lures because the intense feelings invoked by a provocative subject line cause our critical...
Password Spray Attacks Taking Advantage of Lax MFA
In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...
Password Spray Attacks Taking Advantage of Lax MFA
In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...
CVE-2024-55210
An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...
CVE-2024-55210
An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...
CVE-2024-55210
An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...
CVE-2024-55210
A security vulnerability exists in TOTVS Framework (Linha Protheus) version 12.1.2310 that allows attackers to bypass multi-factor authentication (MFA) . The root cause is an issue where a crafted websocket message can be used to circumvent the authentication process. This vulnerability could lea...
CVE-2024-55210
An issue in TOTVS Framework Linha Protheus 12.1.2310 allows attackers to bypass multi-factor authentication MFA via a crafted websocket message...
PT-2025-15840 · Totvs · Totvs Framework
Name of the Vulnerable Software and Affected Versions: TOTVS Framework Linha Protheus version 12.1.2310 Description: An issue in the software allows attackers to bypass multi-factor authentication MFA via a crafted websocket message. Recommendations: For version 12.1.2310, consider disabling...
GHSA-6423-85CC-8GF6 Joomla CMS Multi-Factor Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
Joomla CMS Multi-Factor Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2025-25227
The Joomla CMS is vulnerable to a Multi-Factor Authentication (MFA) bypass due to insufficient state checks in the MultiFactorAuthenticationHandler::needsMultiFactorAuthenticationRedirection() method. The vulnerability occurs because this method calls isMultiFactorAuthenticationPage() without the...