Smule: Missing Rate Limit in Password Change

Incorrect or missing rate limits related to account features...

$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'

More info at https://phabricator.wikimedia.org/T169545...

$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'

More info at https://phabricator.wikimedia.org/T169545...

Weblate: 2nd issue>>> flood of email no rate limit on delete account confirmation email >>

There was no rate limit on delete account confirmation email, leading to user being able to send himself flood of emails...

Passit: app.passit.io is vulnerable against username enumeration

Summary: The application app.passit.io is vulnerable against username enumeration through the use of error messages and dictionary attack. Description: We noted that the application uses GET request with a rate limit of 60 seconds which is too broad. The application returns an error message that...

Raccoon - A High Performance Offensive Security Tool For Reconnaissance And Vulnerability Scanning

Offensive Security Tool for Reconnaissance and Information Gathering. Features DNS details DNS visual mapping using DNS dumpster WHOIS information TLS Data - supported ciphers, TLS versions, certificate details and SANs Port Scan Services and scripts scan URL fuzzing and dir/file detection...

Chaturbate: Rate limit missing at room login

Hello there, User are able to protect there broadcasting with password, so only password granted visitor can login to broadcast room. I notice that rate limit are missing at the endpoint /roomlogin/user/ which enable me to brute force on password field. I made 1k+ request but still server not blo...

SMTP send heap buffer overflow

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The si...

Astra - Automated Security Testing For REST API's

REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can automatically...

Design/Logic Flaw

openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation to fail with 'VolumeInUse' error. Since the delete operation is retried every 30 seconds for each volume, this could lead to a denial of service attack as the...

CVE-2016-9592

The CVE-2016-9592 entry describes a denial-of-service risk in OpenShift before versions 3.3.1.11, 3.2.1.23, and 3.4. The root cause is a flaw where a volume fails to detach, causing the delete operation to fail with a VolumeInUse error. Because the delete operation is retried every 30 seconds for...

REST API Penetration Testing: Astra

REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can automatically...

Shanghai Shenglang Information Consulting Co., Ltd. Chatterbox APP has arbitrary number login vulnerability

Chatterbox is a location-based mobile video social app. Shanghai Shenglang Information Consulting Co., Ltd. Chatty Guest APP exists arbitrary number login vulnerability, the vulnerability is due to the server failed to verify the authentication code request number of times and time to do the limi...

Kindred Group: Full Account Takeover on *.unibet.com due to crossdomain.xml and AkamaiPlayer loaderContext

==Below is the original, partially-redacted report== --------- Hi, The core issue here are two things: 1. The too wide crossdomain.xml located at: https://payment.unibet.com/crossdomain.xml https://se.unibet.com/crossdomain.xml https://www.unibet.com/crossdomain.xml 2. Issues with not-in-scope...

The vulnerability in the TCP transmission rate limitation mechanism, known as TCP-rottling, in the software Connected Grid Network Management System and IoT Field Network Director allows a perpetrator to cause a service failure and restart the device.

The vulnerability in the TCP throughput rate-limiting mechanism of the Connected Grid Network Management System and IoT Field Network Director software involves insufficient protection for the throughput rate limit requiring additional memory. Exploiting this vulnerability allows a malicious acto...

CVE-2017-14937

The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access SA data to the internal CAN bus or the OBD connector. This affects the airbag control units aka pyrotechnical control units or PCUs of unspecified passenger vehicles manufactured in 2014 or...

Infogram: No Rate Limit on account deletion request(Leads to huge email flooding/email bombing)

Dear sir, At first,i want to say that this sensitive action definitely should be set with rate limit. Note:-This is about huge bombing/brute force on any endpoints. Vulnerability:- -No rate limit has been set for generating account deletion emails for accounts on above selected domain. -As there ...

Infogram: No Rate limit on Password Reset Function

Hello Infogram Security Team Description:- I have identified that when resetting the password, the request has no rate limit which then can be used to brute force through one request. Which can be annoying to the infogram users. Steps to reproduce:- Request for password reset link. Catch the abov...

Instacart: Get all instacart emails - missing rate limit on /accounts/register

Hey Instacart team, When signing up for an account, you enter your email. When this email is already in use, the server responds with ""errors":"email":"has already been taken"" This in not a problem, but the fact that you could send this request unlimited times is the issue. This way we can easi...

Instacart: Bruteforcing password reset tokens, could lead to account takeover

Hey Instacart security team, Description When resetting a new password on https://shoppers.instacart.com/password you will receive an email with a reset link. when clicking on this link. you go to this page: https://shoppers.instacart.com/password/edit?resetpasswordtoken=YourToken when entering a...