2356 matches found
CVE-2023-48833
A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion...
CVE-2023-48831
A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion...
CVE-2023-48840
CVE-2023-48840 affects PHPJabbers Appointment Scheduler 3.0. The issue is a lack of rate limiting in the function pjActionAjaxSend , which can lead to resource exhaustion. Public sources describe the affected software and vulnerability pattern, with public exploit details referenced by PacketStor...
Car Rental Script Security Vulnerability
Car Rental Script is a vehicle rental script in GZ Script open source . Car Rental Script v3.0 version has a security vulnerability , the vulnerability stems from the lack of rate limiting in pjActionAJaxSend , resulting in an attacker can exhaust system resources...
Appointment Scheduler Security Vulnerability
PHPJabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and booking meeting schedules from PHPJabbers Serbia. A security vulnerability exists in Appointment Scheduler version 3.0, which stems from a lack of rate limiting in pjActionAJaxSend, allowing an...
PT-2023-30977 · Unknown · Car Rental
Name of the Vulnerable Software and Affected Versions: Car Rental version 3.0 Description: A lack of rate limiting in pjActionAjaxSend allows attackers to cause resource exhaustion. Recommendations: For Car Rental version 3.0, consider implementing rate limiting for the pjActionAjaxSend function ...
PT-2023-30975 · Unknown · Availability Booking Calendar
Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: A lack of rate limiting in pjActionAJaxSend allows attackers to cause resource exhaustion. Recommendations: For Availability Booking Calendar version 5.0, consider implementing rate...
PT-2023-30976 · Unknown · Time Slots Booking Calendar
Name of the Vulnerable Software and Affected Versions: Time Slots Booking Calendar version 4.0 Description: A lack of rate limiting in the pjActionAJaxSend function allows attackers to cause resource exhaustion. Recommendations: For Time Slots Booking Calendar version 4.0, consider implementing...
PHPJabbers Appointment Scheduler 3.0 Missing Rate Limiting
Exploit Title: PHPJabbers Apointment Scheduler v3.0 - No Rate Limit in Email Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/appointment-scheduler/ Version: v3.0 Tested on: Windows...
PHPJabbers Time Slots Booking Calendar 4.0 Missing Rate Limiting
Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - No Rate Limit in Email Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested...
PHPJabbers Availability Booking Calendar 5.0 Missing Rate Limiting
Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - No Rate Limit in Email Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/sectionDemo...
Denial Of Service (DoS)
apachesuperset is vulnerable to Denial Of Service DoS. The vulnerability is caused by a lack rate limiting in the API and dashboard functionalities. An attacker with authenticated access, could exploit this vulnerability by initiating multiple concurrent requests for dashboard exports. This can...
CVE-2023-42504 Apache Superset: Lack of rate limiting allows for possible denial of service
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...
CVE-2023-42504 Apache Superset: Lack of rate limiting allows for possible denial of service
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...
Theme My Login 2FA < 1.2 - Lack of Rate Limiting
Description The plugin does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits. https://packetstormsecurity.com/2309-exploits/wpmylogin-bruteforce.txt...
Theme My Login 2FA < 1.2 - Lack of Rate Limiting
Description The plugin does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits. PoC https://packetstormsecurity.com/2309-exploits/wpmylogin-bruteforce.txt...
Authentication Bypass
LibreNMS is vulnerable to Authentication Bypass. The vulnerability is due to improper rate limiting checks on login mechanisms using the GET method in the /?username=admin=password= endpoint. This can be exploited by an attacker to perform a brute force attack at the login endpoint, resulting in...
CVE-2023-46745 Rate limiting Bypass on login page in libreNMS
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user account...
GHSA-RQ42-58QF-V3QX LibreNMS vulnerable to rate limiting bypass on login page
Summary Application is using two login methods and one of them is using GET request for authentication. There is no rate limiting security feature at GET request or backend is not validating that. PoC Go to /?username=admin&password=password&submit= Capture request in Burpsuite intruder and add...
LibreNMS vulnerable to rate limiting bypass on login page
Summary Application is using two login methods and one of them is using GET request for authentication. There is no rate limiting security feature at GET request or backend is not validating that. PoC Go to /?username=admin&password=password&submit= Capture request in Burpsuite intruder and add...