2284 matches found
FreeBSD : Istio -- Security vulnerabilities (484d3f5e-653a-11e9-b0e3-1c39475b9f84)
Istio reports : Two security vulnerabilities have recently been identified in the Envoy proxy. The vulnerabilities are centered on the fact that Envoy did not normalize HTTP URI paths and did not fully validate HTTP/1.1 header values. These vulnerabilities impact Istio features that rely on Envoy...
Rate Limiting Bypass
Overview All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...
WordPress Limit Login Attempts Reloaded 2.7.4 Bypass Exploit
WordPress Limit Login Attempts Reloaded plugin version 2.7.4 suffers from a login limit bypass vulnerability. !/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link:...
WordPress Limit Login Attempts Reloaded 2.7.4 Bypass
!/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded Version: 2.7.4 Tested on: WordPress 5.1.1 Descriptio...
WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass
!/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded Version: 2.7.4 Tested on: WordPress 5.1.1 Descriptio...
U.S. Dept Of Defense: Email PII disclosure due to Insecure Password Reset field
Summary: I revisited report 235041 and discovered the vulnerability isn't patched properly as I was able to discover more emails I could gleam. It appears the core mechanism allows anyone who knows specific names or user names to leak sensitive emails Description: This password reset field allows...
Istio -- Security vulnerabilities
Istio reports: Two security vulnerabilities have recently been identified in the Envoy proxy. The vulnerabilities are centered on the fact that Envoy did not normalize HTTP URI paths and did not fully validate HTTP/1.1 header values. These vulnerabilities impact Istio features that rely on Envoy ...
Semmle: Unprotected Api EndPoints
Summary: I am able to automate the get/post requests of the following api end-points with a python script which can lead to heavy load to server resulting in dos attack or buffer overflow. /internalapi/v0.2/getSuggestedProjects /internalapi/v0.2/getLanguages /internalapi/v0.2/getLoggedInUser...
Packet Pacing Benefits for Midgress Traffic
Akamai's Smooth Delivery Pacing SDP made an impression last year by increasing client network performance while simultaneously reducing retransmissions. If you missed the details and want to learn more about SDP, please check out our past discussion. In this article, we'll explore if SDP's benefi...
RATELIMITED: Hackerone1
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...
CVE-2018-1000845
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultID: CVE-2017-6519. Reason: This candidate is a duplicate of CVE-2017-6519. Notes: All CVE users should reference CVE-2017-6519 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...
Enhancing Network Performance with Packet Pacing
Introduction Akamai's Smooth Delivery is a network performance enhancement initiative spearheaded by the Protocol Optimization team. It consists of two parts - each focused on reducing congestion while enhancing network performance. 1. TCP Pacing - The topic of this post 2. Rate Limiting -...
Chaturbate: No rate limiting in starting up a bot.
hi security team, I was able to start up a bot numerous times. 1. Goto https://chaturbate.com/b/username 2. Choose a bot and capture the request. 3. Send to intruder and repeat the step numerous times. 4. I did this 196times 5.I was able to activate a bot numerous times 6. My room was flooded wit...
Chaturbate: No rate limiting in changing room subject.
Before i shed more light on this: I noticed i can create over 200 apps but i don't really know how valid that was. I want to report that there is no rate limiting in changing room subject. Attacker scenrio: 1. Navigate to https://chaturbate.com/b/your username 2. Try to create a room subject and...
SUSE-SU-2018:2762-1 Security update for crowbar, crowbar-core, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui
This update for crowbar, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui fixes the following issues: This security issues was fixed: - CVE-2018-3760: Upgrade rubygem-sprockets to prevent an information leak. Specially crafted requests could have been be used to access files that exists on...
HackerOne: User login page doesn't implement any form of rate limiting
Hi Team, Summary: As a best practice a login page should have a rate limitting just like hackerone.com Vulnerable Request POST /auth/postlogin HTTP/1.1 Host: ctf.hacker101.com User-Agent: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ctf.hacker101.com/...
Caixin Media Limited Caixin App has SMS Bombing Vulnerability
Caixin APP is the must-read financial information client of Caixin Media, providing users with comprehensive, in-depth, instant and accurate financial news and information information. Caixin APP of Caixin Media Co., Ltd. suffers from SMS bombing vulnerability, the vulnerability stems from the...
Shanghai Pu Ding Culture Communication Co.
Tiger Tour is a self-guided tour service platform founded and operated by Shanghai Purding Culture Communication Co. Ltd. Tiger Tours APP has an SMS bombing vulnerability, the vulnerability stems from the failure of the server side to limit the number of times and time of CAPTCHA requests for the...
SUSE-SU-2018:2603-1 Security update for crowbar, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui
This update for crowbar, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui fixes the following issues: This security issues was fixed: - CVE-2018-3760: Upgrade rubygem-sprockets to prevent an information leak. Specially crafted requests could have been be used to access files that exists on...