CVE-2022-34770

CVE-2022-34770 concerns Tabit exposure of sensitive information via multiple web APIs that reveal health statements, bills, alcohol consumption, and smoking habits without proper authorization. Affected components include endpoints that expose MongoDB IDs in their URLs and rely on tiny URLs like ...

CVE-2022-34770 Tabit - sensitive information disclosure

Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoD...

PT-2022-22321 · Tabit · Tabit

Name of the Vulnerable Software and Affected Versions: Tabit affected versions not specified Description: The issue concerns the disclosure of sensitive information through several APIs on the Tabit web system. These APIs display health statements, previous bills, alcohol consumption, and smoking...

PT-2022-22323 · Tabit · Tabit

Name of the Vulnerable Software and Affected Versions: Tabit affected versions not specified Description: The issue concerns password enumeration in the Tabit system, which uses a 4-digit One-Time Password OTP. An attacker can resend the OTP and attempt to log in indefinitely, highlighting a lack...

CVE-2022-34772

Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting...

CVE-2022-34770

Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoD...

OctoPrint does not have rate limiting on the login page

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...

GHSA-5W5X-Q9P5-9QG3 OctoPrint does not have rate limiting on the login page

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...

OctoPrint 安全漏洞

OctoPrint is an application. It provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint that stems from a lack of request rate limiting on the login screen that allows an attacker to brute-force a username and password to take over any...

CVE-2022-35488

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

CVE-2022-35488

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

Default credentials

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

CVE-2022-35488

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

CVE-2022-35488

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

CVE-2022-35488

CVE-2022-35488 affects Zammad 5.2.0. The vulnerability stems from insufficient rate-limiting in the forgot-password flow, allowing an attacker to generate many requests for a known account and trigger mass-email delivery, resulting in Denial of Service and potential user spam. Red Hat and CVE rec...

PT-2022-22864 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows an attacker to manipulate the rate limiting in the 'forgot password' feature, enabling them to send numerous requests for a known account. This can cause Denial Of Service due to the generati...

CVE-2022-35925

BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...

CVE-2022-35925

CVE-2022-35925 affects BookWyrm prior to version 0.4.5, where authentication views lacked rate limiting, enabling brute-force attacks. The Red Hat/Red Hat-linked and other databases confirm the same issue. Root cause: missing rate limiting on login/auth endpoints. Impact (as stated): potential fo...

CVE-2022-35925 Missing rate limit in Authentication in bookwyrm

BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...

PT-2022-23031 · Bookwyrm · Bookwyrm

Name of the Vulnerable Software and Affected Versions: BookWyrm versions prior to 0.4.5 Description: BookWyrm, a social network for tracking reading, has an issue where versions prior to 0.4.5 lack rate limiting on authentication views. This lack of rate limiting allows for brute-force attacks. T...