CVE-2015-7705

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...

Code injection

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...

CVE-2015-7705

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...

DEBIAN-CVE-2015-7705

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...

CVE-2015-7705

Removed by vendor...

CVE-2015-7705

CVE-2015-7705 describes a DoS vulnerability in NTP’s rate-limiting: remote attackers can cause a client to delay/stop querying time sources by sending forged Kiss-of-Death messages. Affected are NTPd 4.x before 4.2.8p4 and 4.3.x before 4.3.77; multiple vendors (e.g., F5 BIG-IP, Debian, Arista/EOS...

CVE-2015-7705

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...

Weblate: No rate limit or captcha to identify humans

Affected URL: https://hosted.weblate.org/hosting/ Issue: There is no captcha or rate limit to protect from bots against adding request for new project hosting. Which makes it easy for an attacker to perform spamming. Shall you need any more info notify me,...

CVE-2015-7705: Improper Input Validation

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...

Legal Robot: SSL BREACH attack (CVE-2013-3587)

Hello security team, The site legalrobot.com is potentially vulnerable to the BREACH attack. Allowing an attacker the ability to: - Inject partial chosen plaintext into a victim's requests - Measure the size of encrypted traffic - can leverage information leaked by compression to recover targeted...

Legal Robot: 2FA user enumeration via login

While going live with additional 2FA options, a security researcher discovered that during login, users that had enabled 2FA were prompted for a second factor, even with an incorrect password i.e. LR correctly rejected the login attempt without a second factor, but rejected all attempts for that...

Legal Robot: 2FA user enumeration via password reset

While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2...

WakaTime: by pass rate limit exceed

ERROR 429 FOR RATE LIMIT EXCEED to access login page when am trying to access login page after couple of request web server shows 429 error,after refreshing the same page i got an access log in page, this is because of weak rate limit exceed THANKING YOU...

voipratetracker.com XSS vulnerability

Vulnerable URL: http://www.voipratetracker.com/redirect/top.php?out.%22%3EKeritzy%3Cimg%20src=x%20onerror=prompt%28/xssposed/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

WakaTime: No rate limit on creating private leaderboards.

Hey Alan Similar to report 244813 , there is no rate limit in creating private leaderboards , I was able to create more than 300 private leaderboards on my test id. Kindly look into it. Ping me back if i am unable to demonstrate the issue. Regards Ahmad...

callahan-roach.com XSS vulnerability

Vulnerable URL: http://www.callahan-roach.com/flat-rate-detail.asp?industry=1"...

WakaTime: No rate limiting for confirmation email, can spam anyone with confirmation emails

Hello, there is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Proof of Concept : 1. Register a account in wakatime.com 2. Login to account and go to https://wakatime.com/settings/account 3. Unde...

WakaTime: No rate limit when creating new goals [https://wakatime.com/goals]

Hi there, I was testing and found out that there's no rate limit on goals section https://wakatime.com/goals that means you can create multiple goals in a sec, which would lead to server crash since there's no limit per request that a user can make. I made at least 100 request, and still got 200 ...

arxius: Missing Rate Limit for Password Reset Verification - Vulnerable to brute force

Description The password reset verification do not seem to contain rate limit which is implemented in the email verification on sign up. The password reset link looks like this: https://arxius.io/password/EMAIL%40DOMAIN.COM/RESTTOKEN On clicking the link, it prompts to enter a new password. When...

CVE-2015-9099

The lameinitparams function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service invalid read and application crash via a crafted audio file with a negative sample rate...