1052 matches found
GHSA-9G3V-V24Q-JJ5P rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks
rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts...
PT-2022-18578 · Unknown · Octopus Deploy
Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows bypassing rate limiting on login using null bytes. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...
Yelp: no rate limit in forgot password session
A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429: Too Many...
No rate limit on old password parameter allows attacker to bruteforce the existing password and set a new password
Description There is no rate limit on the password change feature on https://rdiffweb-demo.ikus-soft.com/prefs/general which allows an attacker to bruteforce the old password and set a new password for the account Proof of Concept 1 Go to https://rdiffweb-demo.ikus-soft.com/prefs/general 2 Here y...
Yelp: No rate limit on subscribe form
Summary: Hi team, I found that you missing a rate limit protection for subscribe form Platforms Affected: https://business.yelp.com/?source=consumersiteheader&utmcontent=header&utmmedium=www&utmsource=conshome Steps To Reproduce: 1. go to...
No rate limit via proxy url parameter
Description Hi Drawio Team , Your proxy server has no limit of requests which an attacker can use it as PORT SCANNER. https://app.diagrams.net/proxy?url=IP:PORT&base64=1 Proof of Concept Image from my OWASP ZAP : https://ibb.co/h87hz3N...
Login bruteforce
Description According to the fix of the previous report, the login page has a rate limit mechanism to block the user’s IP when many attempts are made. The endpoint, for example, /v2/console/status only returns the content when who made the request has the correct rights. However, this request is...
Privilege Escalation
octoprint is vulnerable to privilege escalation. The vulnerability exists because of the lack of a rate limit on the login page, allowing an attacker to guess user passwords and gain access to user and administrative accounts...
No rate limit on main Login page lead to account takeover
Hi Team, Summary: As a best practice a login page should have a rate limit to avoid any kind of brute force. Aslo The password policy used in the account creation and password change pages is weak, allowing to set a password of only 1 character...
CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation
Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...
Missing rate limit when trying to join a password protected Nextcloud Talk conversation
None...
Zammad 资源管理错误漏洞
Zammad is a ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from the "Forgot Password" feature that does not limit the rate of requests, which allows an attacker to send many requests to a victim, generating too many...
Account Takeover [namelessmc.com]
Description: 1. Hello team, while i was testing on https://namelessmc.com/login/ i noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field Steps to reproduce: 1. 1- go to https://namelessmc.com/login/ 2. 2- Ente...
CVE-2022-35925 Missing rate limit in Authentication in bookwyrm
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...
Design/Logic Flaw
Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unabl...
CVE-2022-31184
CVE-2022-31184 affects Discourse; an abuse of the email activation route allows mass-spam via unmitigated email flows. The root cause is not deeply detailed in the provided documents, but the mitigation is explicit: a fix has been included in the latest stable, beta, and tests-passed Discourse re...
Discourse 安全漏洞
Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A security vulnerability exists in Discourse stable 2.8.6 and earlier, Discourse beta 2.9.0.beta7 and earlier, and Discourse tests-passed 2.9.0.beta7 and earlier, whi...
PT-2022-20594 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: Discourse is an open source discussion platform. In affected versions, an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta...
CVE-2022-2366
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers...
CVE-2022-2366
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers...