HackerOne: Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)

Hi there, I noticed when we hit the /userssignin endpoint too many times it will give us HTTP/1.1 429 Too Many Requests Date: Mon, 19 Sep 2016 01:52:19 GMT Content-Type: text/plain However, this can be "reset" although I struggle to get it to work EVERYTIME on /users/signin. This however, does wo...

OLX: Bypassing Phone Verification For Posting AD On OLX

Overview In computer networks, rate limiting is used to control the rate of traffic sent or received by a network interface controller. It can be induced by the network protocol stack of the sender due to a received ECN-marked packet and also by the network scheduler of any router along the way...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2016:1633 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Oracle Linux 7 : kernel (ELSA-2016-1633)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1633 advisory. - net tcp: enable per-socket rate limiting of all 'challenge acks' Florian Westphal 1355603 1355605 CVE-2016-5696 - net tcp: uninline tcpoowratelimited Florian...

kernel: challenge ACK counter information disclosure.

It was found that the RFC 5961 challenge ACK rate limiting as implemented in the Linux kernel's networking subsystem allowed an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the chang...

Instacart: Brute force login and bypass locked account restrictions via iOS app

When logging in to an account on the website, a user's account gets locked out after 15 tries to prevent an attacker from brute forcing access to the account. These same restrictions do not apply to the mobile sign-in endpoint a POST request to https://www.instacart.com/oauth/token, which allows ...

bitaccess: Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error.

Due to a bug on session management, Rate limit was not properly applied to some functionalities on the website, which let a bad actor to send unlimited password reset emails by bypassing the Recaptcha rate limit. This was not a security issue, fixed to prevent spamming users...

OLX: Full Account Takeover

Issue resolved by the OLX support , at the time of discovery of bug , olx.in was not in scope Whenever a user wants to login through the mobile app , the user enters his mobile number and then he is presented with a screen to enter the OTP . The problem is that there is no rate limiting on the...

SubBrute v2.0 - A DNS meta-query spider that enumerates DNS records, and subdomains

SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting https://www.us-cert.gov/ncas/alerts/TA13-088A . This desi...

MediaWiki < 1.23.14 / 1.25.6 / 1.26.3 Multiple Vulnerabilities

Binary data 9475.prm...

GitLab: Insecure 2FA/authentication implementation creates a brute force vulnerability

Hi All, I believe I've found a vulnerability with regards to your user authentication and 2FA implementation but wasn't sure you'd be interested given the reference to "rate limiting" being out of scope so please bare with me. I also took a quick look at...

Uber Hack lets anyone find Unlimited Promo Codes for Free Uber Rides

An Independent Security Researcher from Egypt has discovered a critical vulnerability in Uber app that could allow an attacker to brute force Uber promo code value and get valid codes with the high amount of up to $25,000 for more than one free rides. Mohamed M.Fouad has discovered a "promo codes...

Nextcloud: No rate limiting on password protected shared file link

User can share any files with link and can also set password for it but issue is there isn't any rate limting implemented there at this feature. So attacker can bruteforce shared link whereas on the other side victim might be thinking he is safe even he shared private file link in publically...

Uber: Bruteforce INVITE codes easy way

As soon as i read the vulnerability disclosed on h1 regarding Possibility to brute force invite codes in riders.uber.com "https://hackerone.com/reports/125505" . I have found similar & easy way to bruteforce invite codes but in different manner . Also, 1680 public invites are waiting for...

FreeBSD : mediawiki -- multiple vulnerabilities (b50f53ce-2151-11e6-8dd3-002590263bf5)

MediaWiki reports : Security fixes : T122056: Old tokens are remaining valid within a new session T127114: Login throttle can be tricked using non-canonicalized usernames T123653: Cross-domain policy regexp is too narrow T123071: Incorrectly identifying http link in a's href attributes, due to m...

Instagram Patches Brute-Force Authentication Flaws

Facebook on Thursday patched a pair of vulnerabilities that enabled brute-force attacks against Instagram passwords, and also hardened its password policy. Researcher Arne Swinnen privately disclosed the flaws in December and in February respectively. One bug was patched in February, while the...

Uber: Phone Number Enumeration

I discovered it is possible to retrieve all Uber's customer's cell phone numbers using an API endpoint. While going through a sign up form, I noticed that the page was making an ajax call to an API to validate the email address being entered and to make sure it doesn't already belong to an accoun...

Uber: CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```

backup.uber.com hosts a CrashPlan backup server on port 443. CrashPlan allows users to backup to a friends computer by entering a 6 digit alphanumeric code. This means there are 2,176,782,336 total CrashPlan friend codes. While this is a high number, it is completely possible to brute force this ...

Dropbox: No Rate Limiting while sending the feedback under Dropbox Help Centre

The original report allows repeatedly giving "not helpful" as feedback for a help article. Observation:- It was observed that there is no rate limiting in placed for all the endpoint which looks like as below:- Vulnerable URL:- https://www.dropbox.com/helpajax/articles/274/feedback/unhelpful...

New Relic: Mobile Authentication Endpoint Credentials Brute-Force Vulnerability

Dear, Your web authentication login endpoint, https://login.newrelic.com/login, currently properly protects against brute-force attacks. After a couple of 100 automated login attempts, a Captcha is required to login to the account under attack, even from a different IP address. Perfect, good job....