Zimbra Collaboration 安全漏洞

Zimbra Collaboration is an open source enterprise email and collaboration platform from Zimbra that supports email, calendaring, document management, and team collaboration features. A security vulnerability exists in Zimbra Collaboration that stems from the EnableTwoFactorAuthRequest SOAP endpoi...

PT-2025-38083

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS affected versions not specified Description: A flaw exists in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration ZCS that allows an attacker with valid user credentials to bypass Two-Factor...

CVE-2025-54391

CVE-2025-54391 affects Zimbra Collaboration (ZCS) via the EnableTwoFactorAuthRequest SOAP endpoint. The vulnerability allows an attacker with valid credentials to configure an additional 2FA method (third‑party authenticator app or email-based 2FA) without presenting a valid authentication token ...

Malicious code in @duckdb/node-api (npm)

The DuckDB Node.js package @duckdb/node-api version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

MAL-2025-46992 Malicious code in @duckdb/node-api (npm)

The DuckDB Node.js package @duckdb/node-api version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

Malicious code in @duckdb/node-bindings (npm)

The DuckDB Node.js package @duckdb/node-bindings version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and...

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer's account was compromised in a phishing attack. The attack targeted Josh Junon aka Qix, who received an email message that mimicked npm "[email protected]", urging them to update their update...

Weblate 代码问题漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A code issue vulnerability exists in Weblate versions prior to 5.13.1 that stems from a long session expiration during second factor authentication, which could bypass rate limiting...

Linux Distros Unpatched Vulnerability : CVE-2025-3625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging in...

Linux Distros Unpatched Vulnerability : CVE-2025-3627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their...

Two-factor Authentication Bypass

github.com/komari-monitor/komari is vulnerable to two-factor authentication bypass. The vulnerability is due to a logic error in the 2FA verification condition, which allows an attacker to bypass the two-factor authentication mechanism...

Linux Distros Unpatched Vulnerability : CVE-2021-37156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is fo...

Linux Distros Unpatched Vulnerability : CVE-2022-1963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versio...

Linux Distros Unpatched Vulnerability : CVE-2020-13308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from...

CVE-2025-7955

The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentraladminlogin2faverify function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identic...

DRUPAL-CONTRIB-2025-098

This module allows users to setup two-factor authentication 2FA using authenticator apps for enhanced login security. The module did not protect all possible login paths provided by core modules. CVSS risk score experimental 6.3 / Medium...

Linux Distros Unpatched Vulnerability : CVE-2020-10079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, ...

Linux Distros Unpatched Vulnerability : CVE-2020-13289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activate...

Linux Distros Unpatched Vulnerability : CVE-2021-39874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. CVE-2021-39874 Note that Nessus relie...

Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098

This module allows users to setup two-factor authentication 2FA using authenticator apps for enhanced login security. The module did not protect all possible login paths provided by core modules. CVSS risk score experimental 6.3 / Medium...