Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2017-1023)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-1222)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-2066)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Yelp: No rate limiting for confirmation email lead to email flooding

Description: There is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Affected URL: https://biz.yelp.com/welcome/resendconfirmation with POST method Details: 1. Login to biz.yelp.com 2. Go to...

Stripo Inc: No Rate Limiting on /reset-password-request/ endpoint

Hi there ! I noticed when we hit the /reset-password-request/ endpoint too many times via some proxy for e.g:- Burp there is no rate limit on that endpoint and you can spam the email with 100's of requests and resend even more password reset emails to the users as there is no rate limiting on tha...

MTN Group: Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP code

I attached a PDF document to this report which explained the vulnerability in full details and I also attached a link to the POC video in the document. Impact Account take over of about any MTN user account...

Ultimate Facebook Scraper - A Bot Which Scrapes Almost Everything About A Facebook User'S Profile Including All Public Posts/Statuses Available On The User'S Timeline, Uploaded Photos, Tagged Photos, Videos, Friends List And Their Profile Photos

Tooling that automates your social media interactions to collect posts, photos, videos, friends, followers and much more on Facebook. Features A bot which scrapes almost everything about a facebook user's profile including uploaded photos tagged photos videos friends list and their profile photos...

Clario: No rate limiting on password reset page

Summary https://account.mackeeper.com hasn't enforced rate limiting on the password-reset page. By this, an attacker can send huge amounts of requests to the server for changing the password. Steps to Reproduce 1. Go to the forgot password page and enter your email. 2. Turn 'Intercept on' in Burp...

CVE-2013-5661

Cache Poisoning issue exists in DNS Response Rate Limiting...

Design/Logic Flaw

Cache Poisoning issue exists in DNS Response Rate Limiting...

CVE-2013-5661

Cache Poisoning issue exists in DNS Response Rate Limiting...

CVE-2013-5661

The connected documents consistently describe CVE-2013-5661 as a DNS cache poisoning issue in the DNS Response Rate Limiting mechanism of ISC BIND. The vulnerability is tied to BIND’s handling of responses that can be poisoned to contaminate DNS caches. Concrete details (affected versions, exact ...

CVE-2013-5661

Cache Poisoning issue exists in DNS Response Rate Limiting...

CVE-2013-5661: Authentication Bypass by Spoofing

Cache Poisoning issue exists in DNS Response Rate Limiting...

PT-2019-6988

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description A Cache Poisoning issue exists in DNS Response Rate Limiting. Recommendations At the moment, there is no information about a newer version that contains a fix for this issue...

Insecure Authentication Mechanism

craftcms/cms is uses an insecure authentication mechanism. There is no account lockout after multiple failed attempts to log-in and the application does not rate-limit the elevated session password prompt, allowing an attacker to perform a brute-force attack on the log-in function and discover...

CVE-2019-15929: Weak Password Recovery Mechanism for Forgotten Password

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2066)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number o...

MGASA-2019-0279 Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: Potential XSS in jQuery CVE-2019-11358. An account can be logged out without using a token CSRF CVE-2019-12466. A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them CVE-2019-12467. Directly...

Discourse < 2.4.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities including CSRF flaws. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...