CVE-2020-35590

CVE-2020-35590 concerns the WordPress plugin limit-login-attempts-reloaded up to version 2.17.4. The vulnerability allows bypassing per-IP login rate limits by forging the X-Forwarded-For header; if the plugin is configured to accept an arbitrary header for the client source IP, an attacker can p...

MTN Group: No rate limit lead to otp brute forcing

Summary: Hello. There is no rate limit protection in the endpoint https://mtnonline.com/nim/submit , Which could lead to brute force otp code. How To Reproduce: Visit https://mtnonline.com/nim and complete all the required field and submit. when next page load, user will be ask otp code. Enter an...

F5 Networks BIG-IP : BIG-IP DNS virtual server vulnerability (K52035247)

In a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response.CVE-2020-27721 This can occur under the following conditions : You configure connection rate limiting by either source ordestination...

MTN Group: No rate limit in otp code sending

Summary: There is no rate limit in sendind otp code. Thus, attacker can use this vulnerability to bomb out the mobile inbox of the victim. Steps To Reproduce: Step 1. Open burp suite, and click on "Intercept is on " button from Proxy tab. Step 2. Launch browser and visit https://mtnonline.com/nim...

Stripo Inc: No rate limiting for confirmation email lead to huge Mass mailings

this Report based on 997070 Issue Description No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions then their will be no rate limit set. vulnerable has registred in...

Automattic: [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled

Hello Summary: I have found a no rate limit issue on the report functionality. When you enabled the report functionality on your site, you can set a number of reports before deleting the comment reported. By default, this functionality is unable, but if you enabled this and you set a $x number of...

Stripo Inc: No rate limiting - Create Plug-ins

Hello team Stripo, how are you? I found a rate limit for data creation. Target = https://my.stripo.email/cabinet//plugins/293814 Request to Post: POST /cabinet/stripeapi/v1/plugin/293814/plugins HTTP/1.1 Host: my.stripo.email User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101...

Stripo Inc: No rate limiting - Create data

Summary: Hello team Stripo, how are you? I found a rate limit for data creation. Target = https://my.stripo.email/cabinet//my-services/298427?tab=data-sources Request to Post: POST /emailformdata/v1/amp-lists?projectId= HTTP/1.1 Host: my.stripo.email User-Agent: Mozilla/5.0 X11; Linux x8664;...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A denial of service vulnerability exists in Mozilla Firefox versions prior to 83. The vulnerability stems from the program not rate limiting API calls. An attacker could exploit this vulnerability to...

CVE-2020-27423

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

CVE-2020-27423

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

Design/Logic Flaw

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

CVE-2020-27423

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox...

Anuko Time Tracker 1.19.23.5311 Missing Rate Limiting

Exploit Title: Anuko Time Tracker 1.19.23.5311 No rate Limit on Password Reset functionality Date: 2020-10-11 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.anuko.com/ Software Link: https://www.anuko.com/time-tracker/index.htm Version: 1.19.23.5311 Patched Version: 1.19.23.5325...

Mail.ru: Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass)

Login functionality on certification.mail.ru was not sufficiently protected against bruteforce...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)

Password at top.mail.ru counters was not sufficiently protected against bruteforce...

GitLab Resource Management Error Vulnerability (CNVD-2020-63397)

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...

openSUSE Security Update : nextcloud (openSUSE-2020-1652)

This update for nextcloud fixes the following issues : nextcloud version 20.0.0 fix some security issues : - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 CVE-2020-8228 Missing rate limit on signup page - NC-SA-2020-029 CVE-2020-8233, boo1177346...

OPENSUSE-SU-2020:1652-1 Security update for nextcloud

This update for nextcloud fixes the following issues: nextcloud version 20.0.0 fix some security issues: - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 CVE-2020-8228 Missing rate limit on signup page - NC-SA-2020-029 CVE-2020-8233, boo1177346...

Security update for nextcloud (moderate)

openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2020:1652-1 Rating: moderate References: 1171572 1171579 1177346 Cross-References: CVE-2020-8154 CVE-2020-8155 CVE-2020-8183 CVE-2020-8228 CVE-2020-8233 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1...