1282 matches found
Froxlor vulnerable to Allocation of Resources Without Limits or Throttling
Froxlor prior to 2.0.16 has a password reset page with no rate limit...
GHSA-4GM9-C9JQ-G523 Froxlor vulnerable to Allocation of Resources Without Limits or Throttling
Froxlor prior to 2.0.16 has a password reset page with no rate limit...
Mozilla: If rate limit is hit, IP address is leaked to anyone who tries to login
The rate limit on the login page of Bugzilla allowed the IP address of a user to be leaked to anyone attempting to login after the rate limit was hit...
Rate-limit Bypass
azuracast/azuracast is vulnerable to rate-limit Bypass. The vulnerability exists due to a lack of user request rate limiting when the request headers include random values, which allows an attacker to bypass the login security mechanism...
PT-2023-20023 · Azuracast · Azuracast
Name of the Vulnerable Software and Affected Versions: AzuraCast versions prior to 0.18.3 Description: The issue is related to improper restriction of excessive authentication attempts in the AzuraCast GitHub repository. Specifically, the request rate limiting feature on the login page can be...
CLSA-2023-1683146027 kernel: Fix of 23 CVEs
media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...
No rate limit on send report functionality results in an email spam
Description There is no rate limit on the send report feature on the https://rdiffweb-dev.ikus-soft.com/prefs/notification endpoint , which allows an attacker to spam the victims mailbox Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/notification 2 Click on daily frequency for...
Missing rate limit for password resets
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
CVE-2023-28821
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
Default credentials
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
CVE-2023-28821
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
CVE-2023-28821: Weak Password Recovery Mechanism for Forgotten Password
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
PT-2023-21990 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions prior to 9.1 Description: The issue is related to the lack of a rate limit for password resets in Concrete CMS. This could potentially allow for brute-force attacks on user passwords. Recommendations...
PortlandLabs Concrete CMS 授权问题漏洞
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.1 that stems from the lack of a password reset rate limit...
CVE-2023-28821
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
CVE-2023-28821
Concrete CMS (formerly concrete5) prior to 9.1 is affected by CVE-2023-28821 due to missing rate limiting on password resets in forgot_password. This is a low/medium-severity issue (CVSS 3.1: 5.3) with network attack vector, no privileges required, and no user interaction. The underlying problem ...
ENTAB ERP 1.0 - Username PII leak Vulnerability
Exploit Title: ENTAB ERP 1.0 - Username PII leak Exploit Author: Deb Prasad Banerjee Vendor Homepage: https://www.entab.in Version: Entab ERP 1.0 Tested on: Windows IIS CVE: CVE-2022-30076 Vulnerability Name: Broken Access control via Rate Limits Description: In the entab software in...
Nextcloud: Missing brute force protection for passwords of password protected share links
A missing brute force protection vulnerability was found in the password protection feature of shared files, allowing an attacker to bypass the password protection of the shared files due to the lack of rate limit. This could lead to unauthorized access to protected files...
Nextcloud: Basic auth header on WebDAV requests is not bruteforce protected
A basic authentication bypass vulnerability was discovered on WebDAV requests, due to a lack of rate limit protection. Attackers could brute force the password and gain full account takeover. The vulnerability was reported and fixed...
