275 matches found
CVE-2025-47941 TYPO3 Has Broken Authentication in Backend MFA
TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access...
CVE-2025-47941 TYPO3 Has Broken Authentication in Backend MFA
TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access...
PT-2025-22143 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions 12.x prior to 12.4.31 LTS TYPO3 versions 13.x prior to 13.4.2 LTS Description: The issue concerns the multifactor authentication MFA dialog presented during backend login, which can be bypassed due to insufficient enforcement o...
TYPO3 12.0.0 < 12.4.31 / 13.0.0 < 13.4.12 (TYPO3-CORE-SA-2025-015)
The version of TYPO3 installed on the remote host is 12.0.0 prior to 12.4.31 / 13.0.0 prior to 13.4.12. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2025-015 advisory. - The multifactor authentication MFA dialog presented during backend login can be bypassed du...
ZOHO ManageEngine ADSelfService Plus SQL注入漏洞
ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A security vulnerability exists in ZOHO ManageEngine ADSelfService Plus 6513 and prior versions, which stems from an MFA report of...
Microsoft Secures MSA Signing with Azure Confidential VMs Following Storm-0558 Breach
Microsoft on Monday announced that it has moved the Microsoft Account MSA signing service to Azure confidential virtual machines VMs and that it's also in the process of migrating the Entra ID signing service as well. The disclosure comes about seven months after the tech giant said it completed...
From Third-Party Vendors to U.S. Tariffs: The New Cyber Risks Facing Supply Chains
Introduction Cyber threats targeting supply chains have become a growing concern for businesses across industries. As companies continue to expand their reliance on third-party vendors, cloud-based services, and global logistics networks, cybercriminals are exploiting vulnerabilities within these...
Authentication Bypass
Mattermost is vulnerable to Authentication Bypass. The vulnerability is due to a flaw that allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries...
US Department of Labor’s journey to Zero Trust security with Microsoft Entra ID
For several years, Microsoft has been helping United States federal and state government groups, including military departments and civilian agencies, transition to a Zero Trust security model. Advanced features in Microsoft Entra ID have helped these organizations meet requirements to employ...
Missing Authentication for Critical Function
Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to search APIs including user search,...
Missing Authentication for Critical Function
Overview github.com/mattermost/mattermost/server/v8/channels/web is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to servePluginRequest failing to enforce...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to servePluginRequest failing to enforce multifactor authentication for plugins, even when MFA is meant to be enabled. Remediation Upgrade...
Missing Authentication for Critical Function
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to servePluginRequest failing to enforce multifactor authentication for plugins, even when MFA is...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to servePluginRequest failing to enforce multifactor authentication for plugins, even when MFA is meant to be enabled. Remediation Upgrade...
CVE-2025-25068
CVE-2025-25068 (Mattermost) affects Mattermost Server versions 9.11.x <= 9.11.8, 10.3.x <= 10.3.3, 10.4.x <= 10.4.2, and 10.5.x
Phishing evolves beyond email to become latest Android app threat
There are plenty of phish in the sea, and the latest ones have little interest in your email inbox. In 2024, Malwarebytes detected more than 22,800 phishing apps on Android, according to the recent 2025 State of Malware report. Of those malicious apps, 5,200 could subvert one of the strongest...
Changing the tide: Reflections on threat data from 2024
"Enough Ripples, And You Change The Tide. For The Future Is Never Truly Set." X-Men: Days of Future Past In January, I dedicated some time to examine threat data from 2024, comparing it with the previous years to identify anomalies, spikes, and changes. As anticipated, the number of Common...
CVE-2024-52586 eLabFTW MFA bypass
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW's built-in multifactor authentication mechanism. An attacker who can authenticate locally by knowing o...
CVE-2024-52586
CVE-2024-52586 affects eLabFTW versions 4.6.0 to 5.1.0, where an attacker capable of local authentication can bypass the built‑in MFA and log in regardless of MFA requirements. The issue is documented across multiple sources (Red Hat, CVE list, PT-Security, OSV, NVD, CNVD) with the fixed version ...
CVE-2024-52586 eLabFTW MFA bypass
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW's built-in multifactor authentication mechanism. An attacker who can authenticate locally by knowing o...