Radancy: [www.werkenbijderet.nl] There is no rate limit for vacature-alert endpoints

https://werkenbijderet.nl/vacature-alert lacked a properly configured application specific tuned rate limiting defense mechanism. Because the speed limit was set very high, it was possible to send thousands of mails within 10 minutes. The fix was to implement a middleware which throttles requests...

Huawei Data Communication: Configuring ARP Packet Rate Limiting

After the rate limit for ARP packets is configured, the device counts the number of ARP packets. If the number of ARP packets exceeds the configured threshold within a certain period, the device does not process the excess ARP packets. Copyright C 2020 Greenbone Networks GmbH Some text descriptio...

Brave Software: No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.org

There is no bruteforce protection here https://publishers.basicattentiontoken.org/publishers when i try to changes email's contact account. Also the actual thing is when I put an existing email in the above url's "publisherpendingemail" parameter I get an error response status 400 Bad Request But...

U.S. Dept Of Defense: Members Personal Information Leak Due to IDOR

Summary https://██████ allows anyone to sign up and view other members profile. According to wikipedia, ███████ is part of US DoD "████████": ██████ I signed up with a regular account and noticed that by referencing users ████, I can send thousands of "█████████" and also, using another end-point...

Authentication flaw

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence...

CVE-2020-8827

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence...

CVE-2020-8827: Improper Restriction of Excessive Authentication Attempts

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence...

PT-2020-20310 · Intuit · Argo Api

Name of the Vulnerable Software and Affected Versions: Argo API version 1.5.0 Description: The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures, allowing attackers to submit an unlimited number of authentication attemp...

Staging.every.org: No Rate Limit On Reset Password

Summary: A rate limiting algorithm is used to check if the user session or IP address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP servers can respond with status code 429: Too Many Requests. wikipedia I...

Nord Security: Email address is not validated, No Rate Limit and RCE On Forgot Password Page Of affiliates.nordvpn.com

Go to https://affiliates.nordvpn.com/users/forgotpassword. Enter arbitrary string like %0a or %0a%0d as email. It says, No user account was found for the address given, which proves the query are going till the database. Intercept request using Burp Interceptor, copy to intruder Copy some 300...

SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service DoS or account takeover via credential-stuffing. SoundCloud recently sold a $75 million stake to satellite...

Bumble: On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easilty

Hello there how are you doing ? Go to sign up page and enter a new phone number and you will be redirected to https://bumble.com/registration/confirm-phone . You will receive a easy breakable 4 digit OTP Code . I waited for about 4 hours and the OTP did not expired , This shows that the OTP can b...

Nord Security: No Rate Limit On Forgot Password Page Of affiliates.nordvpn.com

Introduction:- A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP-Servers can respond with status code...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2017-1023)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-1323)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-1222)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-2066)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Yelp: No rate limiting for confirmation email lead to email flooding

Description: There is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Affected URL: https://biz.yelp.com/welcome/resendconfirmation with POST method Details: 1. Login to biz.yelp.com 2. Go to...

Stripo Inc: No Rate Limiting on /reset-password-request/ endpoint

Hi there ! I noticed when we hit the /reset-password-request/ endpoint too many times via some proxy for e.g:- Burp there is no rate limit on that endpoint and you can spam the email with 100's of requests and resend even more password reset emails to the users as there is no rate limiting on tha...

MTN Group: Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP code

I attached a PDF document to this report which explained the vulnerability in full details and I also attached a link to the POC video in the document. Impact Account take over of about any MTN user account...