1051 matches found
No rate limit on send report functionality results in an email spam
Description There is no rate limit on the send report feature on the https://rdiffweb-dev.ikus-soft.com/prefs/notification endpoint , which allows an attacker to spam the victims mailbox Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/notification 2 Click on daily frequency for...
Missing rate limit for password resets
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
CVE-2023-28821
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
Default credentials
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
PortlandLabs Concrete CMS 授权问题漏洞
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.1 that stems from the lack of a password reset rate limit...
CVE-2023-28821
Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...
PT-2023-21990 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions prior to 9.1 Description: The issue is related to the lack of a rate limit for password resets in Concrete CMS. This could potentially allow for brute-force attacks on user passwords. Recommendations...
CVE-2023-28821
Concrete CMS (formerly concrete5) prior to 9.1 is affected by CVE-2023-28821 due to missing rate limiting on password resets in forgot_password. This is a low/medium-severity issue (CVSS 3.1: 5.3) with network attack vector, no privileges required, and no user interaction. The underlying problem ...
ENTAB ERP 1.0 - Username PII leak Vulnerability
Exploit Title: ENTAB ERP 1.0 - Username PII leak Exploit Author: Deb Prasad Banerjee Vendor Homepage: https://www.entab.in Version: Entab ERP 1.0 Tested on: Windows IIS CVE: CVE-2022-30076 Vulnerability Name: Broken Access control via Rate Limits Description: In the entab software in...
Nextcloud: Missing brute force protection for passwords of password protected share links
A missing brute force protection vulnerability was found in the password protection feature of shared files, allowing an attacker to bypass the password protection of the shared files due to the lack of rate limit. This could lead to unauthorized access to protected files...
Nextcloud: Basic auth header on WebDAV requests is not bruteforce protected
A basic authentication bypass vulnerability was discovered on WebDAV requests, due to a lack of rate limit protection. Attackers could brute force the password and gain full account takeover. The vulnerability was reported and fixed...
SUSE CVE-2020-8228
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...
SUSE CVE-2021-41177
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits as as AnonRateThrottle or UserRateThrottle was thus not rat...
CVE-2022-34389
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician...
CVE-2022-34389
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician...
Input validation
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician...
Dell SupportAssist for Home PCs 安全漏洞
Dell SupportAssist for Home PCs is a client application for home computers from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting and more. A security vulnerability exists in Dell SupportAssist for Home PCs, which stems from a rate-limit bypass issu...
CVE-2022-34389
Dell SupportAssist Vulnerability (CVE-2022-34389): rate-limit bypass in a third-party ScreenMeet API component may allow an unauthenticated attacker to impersonate a Dell customer to a Dell support technician. Affected product: Dell SupportAssist; root cause described as rate-limit bypass in the ...
CVE-2022-34389
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician...
CVE-2022-34389
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician...