Cuvva: No rate limiting at POST /2/2017-05-22/send_identifier_token

SUMMARY ---------- Hello, while testing your api I have noticed that the request at POST /2/2017-05-22/sendidentifiertoken does not have any rate limiting made about 60-70 requests and this actually sens an SMS when the type is mobilephone. I agree, this is not a very big issue, but all endpoints...

CVE-2017-6633

A vulnerability in the TCP throttling process of Cisco UCS C-Series Rack Servers 3.00.234 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit...

Design/Logic Flaw

A vulnerability in the TCP throttling process of Cisco UCS C-Series Rack Servers 3.00.234 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit...

CVE-2017-6653

A vulnerability in the TCP throttling process for the GUI of the Cisco Identity Services Engine ISE 2.10.474 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device where the ISE GUI may fail to respond to new or established connection...

CVE-2017-6641

A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service DoS condition on an affected system. The vulnerability is due to a lack of rate-limiting...

Weblate: No Rate Limiting at /contact

Hi Weblate Security Team, How are you? Hope you all have a good day and doing well just like me. : I've found a No Rate Limiting in contact directory of your site because there is no mitigation in there like adding a captcha, In this case the attacker can spam you...

Cisco UCS C-Series Rack Servers TCP Port Denial of Service Vulnerability

A vulnerability in the TCP throttling process of Cisco UCS C-Series Rack Servers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit this...

Cisco Remote Expert Manager Denial of Service Vulnerability

A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service DoS condition on an affected system. The vulnerability is due to a lack of rate-limiting...

Weblate: full path disclosure at hosted.weblate.org/admin/accounts/profile/

Browsing this link https://hosted.weblate.org/admin/accounts/profile/ will ask for admin username and password as asked when browsing https://hosted.weblate.org/admin/accounts/ or https://hosted.weblate.org/admin/ hence disclosing the directory path of forbidden area. screenshot : path.png also i...

Nextcloud: Missing Rate Limiting protection leading to mass triggering of e-mails

The issue is that there is a speed bump missing in the subscription of e-mail for a user. This would eventually let the attacker spam to any random e-mail resulting in exhaustion of resources on your side and I see that you are using Amazon AWS's SES where you are charged per e-mail. If a dedicat...

Weblate: Rate Limit Bypass on login Page

Hi, Your web authentication endpoint, https://demo.weblate.org/accounts/login/ POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, i...

Cisco Unified Communications Manager SIP UDP Throttling DoS (CSCuz72455)

According to its self-reported version, the Cisco Unified Communications Manager CUCM running on the remote device is affected by a denial of service vulnerability in the Session Initiation Protocol SIP UDP throttling process due to insufficient rate limiting protection. An unauthenticated, remot...

CVE-2017-3808

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...

Cisco Unified Communications Manager Denial of Service Vulnerability (cisco-sa-20170419-ucm)

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. Copyright C 2017 Greenbone Networks GmbH Some te...

Facebook Delegated Account Recovery SDKs Published for Java, Ruby Apps

Facebook’s Delegated Account Recovery, a protocol that allows applications to delegate account recovery permission to third-party applications, entered its beta phase today with the release of SDKs and additional support for new platforms. The feature has been running on a trial basis since late...

Trello: Rate limiting of incorrect Two Factor Authentication codes not enforced

Trello has a feature which allows the user to enable Two factor authentication to enhance the security. But no Rate Limiting is present on second authentication, i.e. code sent to Registered Mobile Number. Attacker can try as many attempts as he wants to bypass the 2 factor authentication. So usi...

Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...

Grab: Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App

Description: After my previous report about 2FA bypass on the Profile Edit endpoint i was interested to find enpoint, which will allow me horizontal privileges escalation. So, I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms which allow me to...

ntp, ntpdate, sntp security update

CentOS Errata and Security Advisory CESA-2017:0252 An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Moderate: Red Hat Security Advisory: ntp security update

An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...