2759 matches found
CVE-2025-25227
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2025-25227
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
PT-2025-15469 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla versions up to 4.4.12 and 5.2.5 Description: The issue is related to insufficient state checks, which create a vector allowing attackers to bypass 2FA checks. This leads to improper authentication. Recommendations: For Joomla versions ...
Joomla! 授权问题漏洞
Joomla! is a free, open source content management system open-sourced by Joomla! An authorization issue vulnerability exists in Joomla! that stems from an insufficient status check that results in bypassing two-factor authentication checks...
CVE-2025-32359
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...
CVE-2025-32359
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...
CVE-2025-32359
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...
PT-2025-15072 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad versions 6.4.0 through 6.4.1 Description: The issue concerns client-side enforcement of server-side security in Zammad. Specifically, when users change their two-factor authentication configuration, they are required to re-authenticate...
CVE-2025-32359
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...
Zammad 安全漏洞
Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.4.2, which stems from client-side enforcement of server-side security and could lead to bypassing a two-factor authentication configuration...
CVE-2025-32359
The CVE-2025-32359 entry concerns Zammad 6.4.x prior to 6.4.2, where a security check (re-authentication with the current password when changing two-factor authentication settings) is enforced only on the front end and not when calls are made via the API. Affected software: Zammad 6.4.0–6.4.1 (6....
BIT-JOOMLA-2021-23127 [20210301] - Core - Insecure randomness within 2FA secret generation
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...
BIT-JOOMLA-2021-23126 [20210301] - Core - Insecure randomness within 2FA secret generation
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...
CVE-2025-31694
Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...
Brute Force
Overview alertwise is a Wagtail based weather warnings composing and dissemination tool Affected versions of this package are vulnerable to Brute Force due to insufficient login security measures affected version potentially vulnerable to brute-force and credential-stuffing attacks. The issue ste...
Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing
Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing. This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...
GHSA-HF6C-FGP3-JFCH Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing
Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing. This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...