CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-3871

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password GOTP email two-factor authentication 2FA and the user has not set an email address. In this scenario, the attacker may ent...

CVE-2025-3871

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password GOTP email two-factor authentication 2FA and the user has not set an email address. In this scenario, the attacker may ent...

CVE-2025-3871 Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password GOTP email two-factor authentication 2FA and the user has not set an email address. In this scenario, the attacker may ent...

CVE-2025-3871 Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password GOTP email two-factor authentication 2FA and the user has not set an email address. In this scenario, the attacker may ent...

CVE-2025-3871

CVE-2025-3871 affects Fortra GoAnywhere MFT versions prior to 7.8.1. The issue is a broken access control in the GOTP (email) 2FA flow: if an attacker enters the email address of a known user when prompted and that user has GOTP configured but no email address is set, the user can be disabled, en...

PT-2025-29829 · Fortra · Goanywhere Mft

Name of the Vulnerable Software and Affected Versions: GoAnywhere MFT versions prior to 7.8.1 Description: A broken access control issue in Fortra's GoAnywhere MFT can lead to a denial of service. This occurs when the software is configured to use GoAnywhere One-Time Password GOTP email two-facto...

CVE-2025-7030

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2025-7030

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2025-7030

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2025-7030 Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2025-7030

CVE-2025-7030 affects Drupal Two-factor Authentication (TFA) module prior to 1.11.0. The root cause is a Privilege Defined With Unsafe Actions vulnerability that hinges on incorrectly configured access controls, allowing bypass of certain privilege checks. Affected versions range from 0.0.0 up to...

CVE-2025-7030 Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2025-53545

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

Drupal Two-factor Authentication 安全漏洞

Drupal Two-factor Authentication is a module for the Drupal community. A security vulnerability exists in Drupal Two-factor Authentication versions prior to 1.11.0, which stems from improperly defined permissions that could lead to improper access control...

PT-2025-28475 · Frappe · Press

Name of the Vulnerable Software and Affected Versions: Press versions affected versions not specified Description: The issue concerns a lack of server-side validation for 2FA login, allowing users to circumvent this security measure. Press is a Frappe custom app that manages infrastructure,...

Frappe Technologies Frappe 授权问题漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe Technologies Frappe suffers from an authorization issue vulnerability that stems from a lack of server-side validation, which could lead to...

PT-2025-28755 · Drupal · Drupal Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.10.0 Description: The issue affects the two-factor authentication TFA mechanism, allowing exploitation of incorrectly configured access control security levels due to a privilege...

Versa Networks Versa Director multiple vulnerabilities

RISK EVALUATION Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges. 2. RECOMMENDED PRACTICES Upgrade to fixed versions of Versa Director. See...

DRUPAL-CONTRIB-2025-085

This module enables you to allow and/or require a second authentication method in addition to password authentication. The module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users. This vulnerability is mitigated by the fact...