FreeBSD : mediawiki -- multiple vulnerabilities (b50f53ce-2151-11e6-8dd3-002590263bf5)

MediaWiki reports : Security fixes : T122056: Old tokens are remaining valid within a new session T127114: Login throttle can be tricked using non-canonicalized usernames T123653: Cross-domain policy regexp is too narrow T123071: Incorrectly identifying http link in a's href attributes, due to m...

Instagram Patches Brute-Force Authentication Flaws

Facebook on Thursday patched a pair of vulnerabilities that enabled brute-force attacks against Instagram passwords, and also hardened its password policy. Researcher Arne Swinnen privately disclosed the flaws in December and in February respectively. One bug was patched in February, while the...

Uber: Phone Number Enumeration

I discovered it is possible to retrieve all Uber's customer's cell phone numbers using an API endpoint. While going through a sign up form, I noticed that the page was making an ajax call to an API to validate the email address being entered and to make sure it doesn't already belong to an accoun...

Uber: CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```

backup.uber.com hosts a CrashPlan backup server on port 443. CrashPlan allows users to backup to a friends computer by entering a 6 digit alphanumeric code. This means there are 2,176,782,336 total CrashPlan friend codes. While this is a high number, it is completely possible to brute force this ...

Dropbox: No Rate Limiting while sending the feedback under Dropbox Help Centre

The original report allows repeatedly giving "not helpful" as feedback for a help article. Observation:- It was observed that there is no rate limiting in placed for all the endpoint which looks like as below:- Vulnerable URL:- https://www.dropbox.com/helpajax/articles/274/feedback/unhelpful...

New Relic: Mobile Authentication Endpoint Credentials Brute-Force Vulnerability

Dear, Your web authentication login endpoint, https://login.newrelic.com/login, currently properly protects against brute-force attacks. After a couple of 100 automated login attempts, a Captcha is required to login to the account under attack, even from a different IP address. Perfect, good job....

Uber: Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber Drivers

m.uber.com has an endpoint at https://m.uber.com/proxy-rt/product/city/rider-view that when called will return a list of nearby vehicles. By iterating through all latitudes and longitudes, it is possible to count the total number of active Uber drivers. The full URL to be called is...

Root Servers Were Not Targets of 2015 DDoS Attack

When the Internet’s root name servers are in the line of fire of a DDoS attack, people start to sweat, and with good reason since they are the authoritative servers used to resolve IP addresses. The most recent attacks against the root servers happened over a two-day period starting last Nov. 30,...

Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...

Uber: Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers

Invite codes are 5 alphanumeric lower case characters. This means there are 36 26 + 10 possible options for each space in the invite code. In total this means there are 36^5 or 60,466,176 possible invite codes. Through enumerating through all possible invite codes, one can find the total number o...

Hacker Reveals How to Hack Any Facebook Account

Hacking Facebook account is one of the major queries of the Internet user today. It's hard to find — how to hack Facebook account, but an Indian hacker just did it. A security researcher discovered a 'simple vulnerability' in the social network that allowed him to easily hack into any Facebook...

Legal Robot: Rate limiting on password reset links

Security researcher discovered a potential issue where no rate limiting was applied to sensitive functions, like password reset links...

Cisco Virtual Topology System TCP Connection Functionality Denial of Service Vulnerability

A vulnerability in TCP connection handling by Cisco Virtual Topology System VTS devices could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service DoS condition due to high CPU and memory utilization. The vulnerability is due to a lack of rate limiting in t...

openSUSE Security Update : xen (openSUSE-2015-730)

Xen was updated to fix 6 security issues. These security issues were fixed : - CVE-2014-0222: Validate L2 table size to avoid integer overflows bsc877642. - CVE-2015-4037: Insecure temporary file use in /net/slirp.c bsc932267. - CVE-2015-7835: Uncontrolled creation of large page mappings by PV...

FreeBSD : xen-kernel -- some pmu and profiling hypercalls log without rate limiting (e4848ca4-8820-11e5-ab94-002590263bf5)

The Xen Project reports : HYPERCALLxenoprofop and HYPERVISORxenpmuop log some errors and attempts at invalid operations. These log messages are not rate-limited, even though they can be triggered by guests. A malicious guest could cause repeated logging to the hypervisor console, leading to a...

Deriv.com: User Enumeration : Due to rate limiting on registration

Hi, There is no rate limiting or improper rate limiting on registration action. So it poses risk of user enumeration vulnerability. Attacker will fire brute force on following http request for email parameter and will analysis results as below : If response code : 302 == User doesn't exist If...

MGASA-2015-0421 Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: In MediaWiki before 1.23.11, the API failed to correctly stop adding new chunks to the upload when the reported size was exceeded, allowing a malicious user to upload add an infinite number of chunks for a single file upload CVE-2015-8001. ...

x86: some pmu and profiling hypercalls log without rate limiting

ISSUE DESCRIPTION HYPERCALLxenoprofop and HYPERVISORxenpmuop log some errors and attempts at invalid operations. These log messages are not rate-limited, even though they can be triggered by guests. IMPACT A malicious guest could cause repeated logging to the hypervisor console, leading to a Deni...

xen-kernel -- some pmu and profiling hypercalls log without rate limiting

The Xen Project reports: HYPERCALLxenoprofop and HYPERVISORxenpmuop log some errors and attempts at invalid operations. These log messages are not rate-limited, even though they can be triggered by guests. A malicious guest could cause repeated logging to the hypervisor console, leading to a Deni...

Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2783-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2783-1 advisory. Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default configuration, a remote authenticated attacker...