Design/Logic Flaw

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

CVE-2020-27423

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

PT-2020-16688

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker version 1.19.23.5311 Description The issue is related to a lack of rate limit on the password reset module, which allows an attacker to perform a Denial of Service attack on any legitimate user's mailbox. Recommendations For...

Anuko Time Tracker 1.19.23.5311 Missing Rate Limiting

Exploit Title: Anuko Time Tracker 1.19.23.5311 No rate Limit on Password Reset functionality Date: 2020-10-11 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.anuko.com/ Software Link: https://www.anuko.com/time-tracker/index.htm Version: 1.19.23.5311 Patched Version: 1.19.23.5325...

Mail.ru: Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass)

Login functionality on certification.mail.ru was not sufficiently protected against bruteforce...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)

Password at top.mail.ru counters was not sufficiently protected against bruteforce...

GitLab Resource Management Error Vulnerability (CNVD-2020-63397)

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...

openSUSE Security Update : nextcloud (openSUSE-2020-1652)

This update for nextcloud fixes the following issues : nextcloud version 20.0.0 fix some security issues : - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 CVE-2020-8228 Missing rate limit on signup page - NC-SA-2020-029 CVE-2020-8233, boo1177346...

Security update for nextcloud (moderate)

openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2020:1652-1 Rating: moderate References: 1171572 1171579 1177346 Cross-References: CVE-2020-8154 CVE-2020-8155 CVE-2020-8183 CVE-2020-8228 CVE-2020-8233 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1...

OPENSUSE-SU-2020:1652-1 Security update for nextcloud

This update for nextcloud fixes the following issues: nextcloud version 20.0.0 fix some security issues: - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 CVE-2020-8228 Missing rate limit on signup page - NC-SA-2020-029 CVE-2020-8233, boo1177346...

CVE-2020-8228

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

CVE-2020-8228

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

Design/Logic Flaw

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

CVE-2020-8228

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

CVE-2020-8228

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

CVE-2020-8228

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

CVE-2020-8228

CVE-2020-8228 describes a missing rate limit on the signup page in the Nextcloud Preferred Providers app (version 1.7.0), allowing an attacker to repeatedly set the password. The OpenSUSE security advisory (NC-SA-2020-033) and related OSS notes confirm this CVE and indicate it was addressed in th...

CVE-2020-8228: Improper Restriction of Excessive Authentication Attempts

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

PT-2020-20040

Name of the Vulnerable Software and Affected Versions Preferred Providers app version 1.7.0 Description A missing rate limit in the Preferred Providers app allowed an attacker to set the password an uncontrolled amount of times. Recommendations For version 1.7.0, consider implementing a rate limi...

Stripo Inc: Race condition on my.stripo.email at /cabinet/stripeapi/v1/projects/298427/emails/folders uri

Summary: Hi! I hope you all are pretty good = We have discovered a race condition endpoint Steps To Reproduce: POST /cabinet/stripeapi/v1/projects/298427/emails/folders HTTP/1.1 Host: my.stripo.email Connection: close Content-Length: 23 Accept: application/json, text/plain, / Pragma: no-cache...