SOGo (< 5.12.13)

SOGo versions prior to 5.12.13 contain a vulnerability in TOTP verification that allows brute-force of second-factor codes, enabling attackers with valid passwords to bypass multi-factor authentication.

SOGo versions prior to 5.12.13 are vulnerable to improper restriction of authentication attempts, enabling unauthenticated attackers to perform brute-force attacks against security questions and achieve full account takeover.