CVE-2025-2475 Unauthorized Bot Login Using Credentials

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...

oath-toolkit: Local root exploit in a PAM module

A vulnerability was found in a PAM module, the oath-toolkit. The module gained a feature that allowed placing the OTP state file, called the usersfile, in the home directory of the to-be-authenticated user. The PAM module performed unsafe file operations in the users' home directories. Since PAM...

This Week in Sprng - April 1st, 2025

Hi, Spring fans! Welcome to another exciting installment of This Week in Spring! It's April Fools day, so be wary of things you read on the internet, but it's also the 11th anniversary of Spring Boot 1.0, which was released this day in 2014! that's not an April Fools. Happy birthday! I'm in...

CVE-2024-9901

Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-48057. Notes: All CVE users should reference CVE-2024-48057 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage...

Rising Technosoft CAP back office application 安全漏洞

Rising Technosoft CAP back office application is a back office application from Rising Technosoft India. A security vulnerability exists in Rising Technosoft CAP back office application, which stems from a lack of OTP request rate limiting on the API endpoint, which could lead to OTP bombing or...

Linux Distros Unpatched Vulnerability : CVE-2021-43177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and...

Malicious code in checkout-one-time-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07c8dfeaf38da871c1e555b86d76046f4752bc738bf14ed15147cdadb6d92ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2033 Malicious code in checkout-one-time-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07c8dfeaf38da871c1e555b86d76046f4752bc738bf14ed15147cdadb6d92ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directoristgeneratepasswordresetpincode and resetuserpassword functions...

WordPress Directorist plugin <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin Directorist versions = 8.1...

Veeam My Account Portal - MFA Guide

Veeam Data Cloud MFA Requirements As of July 7, 2026, logging in to Veeam Data Cloud cloud.veeam.com using the Continue with Veeam authentication option now requires that your Veeam Account have Multi-Factor Authentication MFA enabled. If you use the Continue with Microsoft authentication option,...

CVE-2025-1629

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

CVE-2025-1629 Excitel Broadband Private my Excitel App One-Time Password excessive authentication

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

CVE-2025-1629 Excitel Broadband Private my Excitel App One-Time Password excessive authentication

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

CVE-2025-1629

CVE-2025-1629 affects Excitel Broadband Private my Excitel App for Android (version 3.13.0). The issue resides in an unknown function of the One-Time Password Handler, causing improper restriction of excessive authentication attempts. Reported by multiple sources (NVD/Red Hat/CVE listings) with v...

PT-2025-7701 · Excitel Broadband Private · My Excitel App

Name of the Vulnerable Software and Affected Versions: Excitel Broadband Private my Excitel App version 3.13.0 Description: A vulnerability was found in the One-Time Password Handler component, leading to improper restriction of excessive authentication attempts. The vendor was contacted about th...

How Phished Data Turns into Apple & Google Wallets

Carding -- the underground business of stealing, selling and swiping stolen payment card data -- has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovati...

Rupeeseed RupeeWeb 安全漏洞

Rupeeseed RupeeWeb is a state-of-the-art web-based trading platform from Rupeeseed India. A security vulnerability exists in Rupeeseed RupeeWeb that stems from a lack of rate limiting on the API endpoints, allowing an authenticated, remote attacker to send multiple OTP requests, resulting in OTP...

Rupeeseed RupeeWeb 安全漏洞

Rupeeseed RupeeWeb is a state-of-the-art web-based trading platform from Rupeeseed India. Rupeeseed RupeeWeb suffers from a security vulnerability that stems from a flaw in the OTP authentication mechanism that allows bypassing two-factor authentication...

PT-2025-7178 · Rupeeweb · Rupeeweb

Name of the Vulnerable Software and Affected Versions: RupeeWeb trading platform affected versions not specified Description: The issue is caused by missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this by sending multiple OTP requests...