Vimeo: Adding profile picture to anyone on Vimeo

Hi! Brief The profile picture upload feature at https://vimeo.com/settings/profile contains a bug where an access control is missing for uploading a profile picture to a profile ID. This leads to the possibility of uploading a profile picture to any account on Vimeo. Furthermore, since the upload...

X (Formerly Twitter): No rate limiting on creating lists

Hi No rate limiting on creating lists in twitter account hope you guys understand...

unbound: denial of service

The resolver can be tricked into following an endless series of delegations, this consumes a lot of resources. Resolvers fetch the content for domain names by sending queries to authority servers on the internet. One of the responses that authority servers can return is a referral response, which...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

Design/Logic Flaw

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

CVE-2014-4435

The CVE-2014-4435 entry concerns iCloud Find My Mac on macOS prior to 10.10, where rate limiting on the Lost Mode PIN was not properly enforced, enabling brute‑force access via a series of reboots for users in proximity. Connected sources corroborate that the issue affects macOS OS X pre-10.10 an...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

IRCCloud: Weak password policy

Hi there, I noticed that the website does not prevent an user from using this email address as a password. This can lead to some poor password decisions on the clientside. Steps to reproduce - 1. Create a new account and use the email address as the password. - 2. Reset your password and choose...

X (Formerly Twitter): Missing Rate Limiting on https://twitter.com/account/complete

The following link is missing rate limiting https://twitter.com/account/complete by which an attacker can get all the valid phone no. on twitters account. POC :- Screenshot attached...

joola.io: Login password guessing attack

Your joola main login panel does not have rate limiting enabled to prevent brute force attacks on its panel...

Fedora 20 : tuxcut-5.0-15.fc20 (2013-22645)

TuxCut is a utility that protect linux computers against arpspoof attacks Features : - Hide your machine ip/MAC from arp scanner utilities. - list all the live host in your LAN. - cut the connection between any live host and the gateway. - use wondershaper to limit your upload or download speed...

Cisco Unified Communications Manager UDP Memory Leak DoS (CSCub85597)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device insufficiently limits the rate of traffic on certain UDP ports, allowing a remote attacker to cause a denial of service condition by sending UDP packets at a high rate. %NASLMINLEVEL 70300 C Tenabl...

Moderate: Red Hat Security Advisory: bind security and enhancement update

Updated bind packages that fix one security issue and add one enhancement are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Large filter subscriptions can crash a JIRA instance with an OutOfMemoryError

h3. Summary JIRA has no 'rate limiting' or mail limit on filter subscriptions. This means using certain configurations will allow for a significant amount of mail to be created. As this mail is persisted in memory, it's possible to cause OutOfMemoryError's, even with a significant amount of heap...

Large filter subscriptions can crash a JIRA instance with an OutOfMemoryError

h3. Summary JIRA has no 'rate limiting' or mail limit on filter subscriptions. This means using certain configurations will allow for a significant amount of mail to be created. As this mail is persisted in memory, it's possible to cause OutOfMemoryError's, even with a significant amount of heap...

Large filter subscriptions can crash a JIRA instance with an OutOfMemoryError

h3. Summary JIRA has no 'rate limiting' or mail limit on filter subscriptions. This means using certain configurations will allow for a significant amount of mail to be created. As this mail is persisted in memory, it's possible to cause OutOfMemoryError's, even with a significant amount of heap...

CentOS Update for quota CESA-2013:0120 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RHEL 6 : rsyslog (RHSA-2012:0796)

Updated rsyslog packages that fix one security issue, multiple bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...

Moderate: Red Hat Security Advisory: rsyslog security, bug fix, and enhancement update

Updated rsyslog packages that fix one security issue, multiple bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...

Apache 2.4 Comes Out, Major update after 6 years

Apache 2.4 Comes Out, Major update after 6 years The Apache Software Foundation officially released the Apache 2.4 today as the first major update to this leading open-source web-server in more than a half-decade. Apache 2.4 is slated to deliver superior performance to its 2.2 predecessor and...