Weblate: No Rate Limitting at Change Password

Hello Team, I found out that you didnt implement a Rate Limitting on Change Password. Scenario This Scenario is Limited. But some of Programs here consider this. Victim Forgot to logout his/her account in Cafe/Internet Computer Shops. Attacker saw the Account that it is not Logged out having a...

Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit

Summary: In your sub-domain: http://demo.weblate.org , another endpoint doesn't have any rate limit on it to prevent spamming you by posting a lot of questions. Description: Spamming and Possible DOS is being possible due to missing rate limit on this endpoint. Request POST /accounts/email/...

Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form

Summary: In your sub-domain: https://demo.weblate.org/ , there's an endpoint that doesn't have any rate limit on it to prevent spamming you by filling the contact you form multiple times to bomb you with tons of emails. Description: Spamming and Possible DOS is being possible due to missing rate...

CVE-2017-3808

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...

CVE-2017-3808

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...

Cisco Unified Communications Manager Denial of Service Vulnerability (cisco-sa-20170419-ucm)

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. Copyright C 2017 Greenbone Networks GmbH Some te...

CVE-2017-3808: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...

Fedora 25 : ming (2017-d43d46f1ca)

Release 0.4.8 no ABI or API changes - Add PHP7 compatibility - Fix C++ output of disassembler - Fix heap overflows in parser.c CVE-2017-7578 - Avoid division by zero in listmp3 when no valid frame was found CVE-2016-9265 - Don't try printing unknown block CVE-2016-9828 - Parse Protect tag's...

Facebook Delegated Account Recovery SDKs Published for Java, Ruby Apps

Facebook’s Delegated Account Recovery, a protocol that allows applications to delegate account recovery permission to third-party applications, entered its beta phase today with the release of SDKs and additional support for new platforms. The feature has been running on a trial basis since late...

Edit and Replay Network Traffic: tcpreplay

Edit and Replay Network Traffic Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Win32 under Cygwin operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal / Wireshark . It allows you to classify traffic as client o...

RF Transceiver Transmitter

This module powers an HWBridge-connected radio transceiver, effectively transmitting on the frequency set by the FREQ option. NOTE: Users of this module should be aware of their local laws, regulations, and licensing requirements for transmitting on any given radio frequency. This module requires...

Trello: Rate limiting of incorrect Two Factor Authentication codes not enforced

Trello has a feature which allows the user to enable Two factor authentication to enhance the security. But no Rate Limiting is present on second authentication, i.e. code sent to Registered Mobile Number. Attacker can try as many attempts as he wants to bypass the 2 factor authentication. So usi...

Khan Academy: Rate Limitation Vulnerability (DDos)

Rate limiting on account confirmation emails and forgot password...

Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...

Joomla JE Video Rate 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Joomla JE Video Rate 1.0 SQL Injection

Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-video-rate/ Dem...

Joomla! Component JE Video Rate 1.0 - SQL Injection

Joomla! Component JE Video Rate 1.0 - SQL Injection Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Joomla! Component JE Video Rate 1.0 - SQL Injection

Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-video-rate/ Dem...

Grab: Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App

Description: After my previous report about 2FA bypass on the Profile Edit endpoint i was interested to find enpoint, which will allow me horizontal privileges escalation. So, I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms which allow me to...

Oracle Linux 6 / 7 : ntp (ELSA-2017-0252)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0252 advisory. - don't limit rate of packets from sources CVE-2016-7426 - don't change interface from received packets CVE-2016-7429 - fix calculation of root...