Defend Your GraphQL Server Against Excessive Resource Consumption

...

Dovecot IMAP Server 2.2 / 2.3 Missing Rate Limiting

Affected product: Dovecot IMAP Server Internal reference: DOV-6464 Vulnerability type: CWE-770 Allocation of Resources Without Limits or Throttling Vulnerable version: 2.2, 2.3 Vulnerable component: lib-mail Report confidence: Confirmed Solution status: Fixed in 2.3.21.1 Researcher credits: Vendo...

CVE-2024-42466 Lack of resources and rate limiting - login

Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42465 Lack of resources and rate limiting - two factor authentication

Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42465 Lack of resources and rate limiting - two factor authentication

Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42481 Complete crash of host system due to calculateDirectorySize in skyportd

Skyport Daemon skyportd is the daemon for the Skyport Panel. By making thousands of folders & files easy due to skyport's lack of rate limiting on createFolder. createFile, skyportd in a lot of cases will cause 100% CPU usage and an OOM, probably crashing the system. This is fixed in 0.2.2...

CVE-2024-42481 Complete crash of host system due to calculateDirectorySize in skyportd

Skyport Daemon skyportd is the daemon for the Skyport Panel. By making thousands of folders & files easy due to skyport's lack of rate limiting on createFolder. createFile, skyportd in a lot of cases will cause 100% CPU usage and an OOM, probably crashing the system. This is fixed in 0.2.2...

Denial Of Service (DoS)

kibana is vulnerable to Denial Of Service DoS. The vulnerability is due to a specific endpoint without rate limiting, which allows an attacker with Viewer role to send a large number of maliciously crafted requests to that specific endpoint causing Kibana instance to crash...

PT-2024-28259 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts. This...

Informatica: No rate limiting on form[register]

The vulnerability overview is as follows: There was a lack of rate limiting on the formregister endpoint, allowing an attacker to send a large number of requests to the server in rapid succession without any restrictions. This could potentially have led to accelerated service usage and resource...

PT-2024-4265 · Citrix · Citrix Hypervisor +1

Name of the Vulnerable Software and Affected Versions: Citrix Hypervisor versions 8.2 CU1 LTSR XenServer version 8 Description: The issue is related to improper rate limiting in an endpoint, which may allow an attacker to cause a denial of service. A malicious administrator of a guest VM can...

SUSE CVE-2021-47374

In the Linux kernel, the following vulnerability has been resolved: dma-debug: prevent an error message from causing runtime problems For some drivers, that use the DMA API. This error message can be reached several millions of times per second, causing spam to the kernel's printk buffer and...

CVE-2021-47374 dma-debug: prevent an error message from causing runtime problems

In the Linux kernel, the following vulnerability has been resolved: dma-debug: prevent an error message from causing runtime problems For some drivers, that use the DMA API. This error message can be reached several millions of times per second, causing spam to the kernel's printk buffer and...

GitLab 10.1.0 < 13.2.10 / 13.3 < 13.3.7 / 13.4 < 13.4.2 (CVE-2020-13342)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email CVE-2020-13342 Note that Nessus has not tested for...

AZL-42201 CVE-2024-27013 affecting package kernel for versions less than 5.15.158.1-1

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

IBM Aspera Faspex Denial of Service Vulnerability

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A denial of service vulnerability exists in IBM Aspera Faspex, which stems from a lack of API rate limiting, and can be exploited by an attacker to cause a...

CVE-2024-31994 Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will attempt to retrieve this file in whole. If it can be retrieved, it may be stored on the file system in whole leading to possible disk...

CVE-2024-31993 Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrapeimage function will retrieve an image based on a user-provided URL, however the provided URL is not validated to point to an external location and does not have any enforced rate limiting. The response from the...

CVE-2024-31992 Mealie contains a DoS vulnerability in recipe importer

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safescrapehtml function utilizes a user-controlled URL to issue a request to a remote server, however these requests are not rate-limited. While there are efforts to prevent DDoS by implementing a timeout on requests, it...

CVE-2024-31992 Mealie contains a DoS vulnerability in recipe importer

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safescrapehtml function utilizes a user-controlled URL to issue a request to a remote server, however these requests are not rate-limited. While there are efforts to prevent DDoS by implementing a timeout on requests, it...