10367 matches found
Code injection
An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit...
CVE-2021-31645
An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit...
CrackQL - GraphQL Password Brute-Force And Fuzzing Utility
CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. How it works? CrackQL works by automatically batching a single GraphQL...
CVE-2021-31645: Allocation of Resources Without Limits or Throttling
An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit...
PT-2022-10041
Name of the Vulnerable Software and Affected Versions glFTPd version 2.11a Description An issue was discovered that allows remote attackers to cause a denial of service via exceeding the connection limit. Recommendations For glFTPd version 2.11a, at the moment, there is no information about a new...
Moment.js vulnerable to Inefficient Regular Expression Complexity
Impact using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has quadratic N^2 complexity on specific inputs noticeable slowdown is observed with inputs above 10k characters users who pass user-provided strings without sanity length checks to moment...
DEBIAN-CVE-2022-31129
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...
UBUNTU-CVE-2022-31129
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...
Improperly Configured rack_attack.rb does not prevent rate limit attacks
Description The lobsters repository depends upon rackattack.rb to prevent rate limit attacks against the /login or the /login/setnewpassword endpoint, allowing for only 4 requests in a minute. However, this can be bypassed by simply appending some strings like /login.turtles to the endpoint. Proo...
No Rate Limit On Reset Password Page
Description I have identified that when Reset Password for account , the request has no rate limit which then can be used to loop through one request. This can annoy to the root users sending mass password to one email. A rate limiting algorithm is used to check if the user session or IP-address...
Improper Restriction of Excessive Authentication Attempts
Nakama Console does not enforce any limit for the number of unsuccessful login attempts...
WS-2022-0198
Improperly Configured rackattack.rb does not prevent rate limit attacks in lobsters/lobsters...
PT-2022-28156
Name of the Vulnerable Software and Affected Versions Luxon versions 1.x prior to 1.38.1 Luxon versions 2.x prior to 2.5.2 Luxon versions 3.x prior to 3.2.1 Moment versions prior to 2.29.4 Description The issue is related to quadratic N^2 complexity in date and time parsing on specific inputs,...
CVE-2022-31129 Inefficient Regular Expression Complexity in moment
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...
Hiperlink injection in email
BUG ========= Hiperlink injection in email SUMMURY ============= There is no character length limit in user fullname . So, user can set fullname to large number character and also can put link url . DETAILS =============== 1. goto admin account profile and change fullname to bellow Hi, You have...
Mozilla: Potential integer overflow in ReplaceElementsAt
The Mozilla Foundation Security Advisory describes this flaw as: In the nsTArrayImpl::ReplaceElementsAt function, where an integer overflow could occur when the number of elements to replace was too large for the container...
PT-2022-5035 · Hitachi Energy · Hitachi Energy Microscada X Sys600
Name of the Vulnerable Software and Affected Versions: Hitachi Energy MicroSCADA X SYS600 versions 10.2 through 10.3.1 Description: The issue is related to an Improper Input Validation vulnerability in the ICCP stack of Hitachi Energy MicroSCADA X SYS600. This vulnerability can cause a...
WordPress Limit Login Attempts plugin跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Limit Login Attempts plugin prior to 4.0.72 have a cross-site scripting...
The vulnerability of the lim process in microprogramming software in embedded Qualcomm chips allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the lim process in microprogramming software in embedded Qualcomm chips is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the...
CLSA-2022-1656430448 Fixed CVEs in mod_http2-3.module_el8.5.0+2060+6f259f31: CVE-2022-26377, CVE-2022-30556, CVE-2022-28615, CVE-2022-30522, CVE-2022-31813
CVE-2022-30522: modsed: limit memory usage - CVE-2022-26377: modproxyajp: fix HTTP request smuggling - CVE-2022-28615: fix possible out-of-bounds read in apstrcmpmatch - CVE-2022-30556: modlua: fix r:wsread to not return length that point past the end of the storage allocated for the buffer -...