CVE-2024-24827 No rate limits on POST /uploads endpoint in Discourse

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

PT-2024-20593

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed version Description The issue affects Discourse, an open source platform for community discussion, due to the lack of a rate limit on the "POST /uploads" endpoint. This makes...

BIT-DISCOURSE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

GHSA-HMX6-R76C-85G9 Gradio apps vulnerable to timing attacks to guess password

Impact This security policy is with regards to a timing attack that allows users of Gradio apps to potentially guess the password of password-protected Gradio apps. This relies on the fact that string comparisons in Python terminate early, as soon as there is a string mismatch. Because Gradio app...

GHSA-84X2-2QV6-QG56 Nervos CKB P2P DoS Attacks

The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted txhashes, it will mark it in memory to avoid duplicated requests. code → . It is easy to establish a DoS attach by generating random tx hashes. Impact It affects all nodes connected to the P2P...

Nervos CKB P2P DoS Attacks

The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted txhashes, it will mark it in memory to avoid duplicated requests. code → . It is easy to establish a DoS attach by generating random tx hashes. Impact It affects all nodes connected to the P2P...

Devise-Two-Factor vulnerable to brute force attacks

Advisory withdrawn The backing CVE has been rejected Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2F...

GHSA-CHCR-X7HC-8FP8 Devise-Two-Factor vulnerable to brute force attacks

Advisory withdrawn The backing CVE has been rejected Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2F...

Devise-Two-Factor vulnerable to brute force attacks

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. Impact If a...

PHPJabbers Cinema Booking System Security Vulnerability

PHPJabbers Cinema Booking System is a theater booking system from PHPJabbers. A security vulnerability exists in PHPJabbers Cinema Booking System version 1.0, which stems from a lost rate limit vulnerability...

PHPJabbers Meeting Room Booking System Security Vulnerability

PHPJabbers Meeting Room Booking System is a meeting room booking system from the Serbian company PHPJabbers. A security vulnerability exists in PHPJabbers Meeting Room Booking System version 1.0, which originates from a lost rate limit vulnerability...

PHPJabbers Event Booking Calendar Security Vulnerability

PHPJabbers Event Booking Calendar is an event calendar application. A security vulnerability exists in PHPJabbers Event Booking Calendar version 4.0, which stems from the presence of multiple lost rate limit vulnerabilities...

PHPJabbers Hotel Booking System Security Vulnerability

Hotel Booking System is a hotel booking system. A security vulnerability exists in PHPJabbers Hotel Booking System version 4.0, which stems from the presence of a lost rate limit vulnerability...

PHPJabbers Hotel Booking System 4.0 Missing Rate Limiting

Exploit Title: PHPJabbers Hotel Booking System v4.0 - No Rate Limit Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/hotel-booking-system/sectionDemo Version: v4.0 Tested on: Windows...

PHPJabbers Shared Asset Booking System 1.0 Missing Rate Limit

Exploit Title: PHPJabbers Shared Asset Booking System v1.0 - No Rate Limit Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/shared-asset-booking-system/sectionDemo Version: v1.0 Test...

Night Club Booking Software Security Breach

Night Club Booking Software is a PHPJabbers open source night club booking software. A security vulnerability exists in Night Club Booking Software version 1.0, which stems from a lost rate limit vulnerability...

PHPJabbers Car Park Booking System Security Vulnerability

PHPJabbers Car Park Booking System is a parking lot booking system by PHPJabbers. A security vulnerability exists in PHPJabbers Car Park Booking System version 3.0, which stems from the presence of multiple lost rate limit vulnerabilities...

PHPJabbers Event Booking Calendar Security Vulnerability

PHPJabbers Event Booking Calendar is an event calendar application. A security vulnerability exists in PHPJabbers Event Booking Calendar version 4.0, which stems from the presence of multiple lost rate limit vulnerabilities...

PHPJabbers Event Ticketing System Security Vulnerability

PHPJabbers Event Ticketing System is an event ticketing system from the Serbian company PHPJabbers. A security vulnerability exists in PHPJabbers Event Ticketing System version 1.0, which stems from the presence of a lost rate limit vulnerability...

PHPJabbers Shared Asset Booking System Security Vulnerability

PHPJabbers Shared Asset Booking System is a shared asset booking system from PHPJabbers Serbia. A security vulnerability exists in PHPJabbers Shared Asset Booking System version 1.0, which stems from the presence of a lost rate limit vulnerability...