SCADA System SKADA-NEV Auth Bypass

The vulnerability of the SCADA system “SKADA-NEV” is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the user account by force...

Desigo DXR2 Authentication Bypass

The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules is related to the absence of authentication attempt limits. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by...

GHSA-5V8V-66V8-MWM7 Integer overflow in the bundled Brotli C library

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli...

Integer overflow in the bundled Brotli C library

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli...

Mattermost Server does not enforce rate limits on password change attempts

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...

GHSA-QRF6-H5FC-7M96 Mattermost Server does not enforce rate limits on password change attempts

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...

CVE-2022-25169: Allocation of Resources Without Limits or Throttling

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files...

CVE-2022-30775: Allocation of Resources Without Limits or Throttling

xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by for example sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKECXXCOMPILER=afl-clang-fast++ option...

Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

Cross-site request forgery CSRF vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method...

CVE-2022-22971: Allocation of Resources Without Limits or Throttling

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user...

CVE-2022-1428

An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being...

Design/Logic Flaw

An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being...

CVE-2022-1428

CVE-2022-1428 affects GitLab versions prior to 14.8.6, and 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1. The issue is that GitLab was incorrectly verifying throttling limits for authenticated package requests, causing limits to be unenforced. The vulnerability is documented across multiple so...

CVE-2022-1428

An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being...

PT-2022-13881 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 14.8.6 GitLab versions 14.9 through 14.9.4 GitLab versions 14.10 through 14.10.1 Description: The issue in GitLab arises from incorrect verification of throttling limits for authenticated package requests, resulting i...

GitLab < 14.8.6 / 14.9.x < 14.9.4 / 14.10.x < 14.10.1 Multiple Vulnerabilities

According to its self-reported version, the instance of GitLab running on the remote web server is prior to 14.8.6, 14.9.x prior to 14.9.4, or 14.10.x prior to 14.10.1. It is, therefore, affected by the following vulnerabilities: - An improper authorization issue exists in GitLab CE/EE that allow...

Nokogiri vulnerable to DoS while parsing XML entities

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits...

CVE-2022-20757

A vulnerability in the connection handling function in Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper traffic handling when platform limits are...

CVE-2022-20751: Allocation of Resources Without Limits or Throttling

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, which could lead to a denial of service DoS condition on an affected device. This vulnerability is due t...

Requests-Ip-Rotator - A Python Library To Utilize AWS API Gateway's Large IP Pool As A Proxy To Generate Pseudo-Infinite IPs For Web Scraping And Brute Forcing

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing. This library will allow the user to bypass IP-based rate-limits for sites and services. X-Forwarded-For headers are automatically randomised and applied unles...