2360 matches found
CVE-2025-54320
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests...
CVE-2025-54321
CVE-2025-54321 affects Ascertia SigningHub up to version 8.6.8. The issue is a lack of rate limiting on the reset-password function, enabling an authenticated attacker to automate reset requests and trigger email bombing. Impact is described as high (confidentiality, integrity, availability). No ...
Ascertia SigningHub 安全漏洞
Ascertia SigningHub is an electronic signature software from Ascertia UK. A security vulnerability exists in Ascertia SigningHub version 8.6.8 and prior versions, which stems from a lack of rate limiting in the Invite Users feature and could lead to email bombing...
CVE-2025-54321
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...
BIT-MOODLE-2025-62399 Moodle: password brute force risk when mobile/web services enabled
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks...
PT-2025-47088
Name of the Vulnerable Software and Affected Versions Ascertia SigningHub versions through 8.6.8 Description A lack of rate limiting on the invite user function allows for an email bombing attack. An authenticated attacker can automate invite requests to a target email address. Recommendations...
Improper Resource Management
Dragonfly is vulnerable to Improper Resource Management. The vulnerability is due to the processPieceFromSource method failing to update the usedTraffic field because of an uninitialized variable, which allows an attacker to exploit incorrect rate limiting and cause a denial-of-service condition...
CVE-2025-34249
Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...
CVE-2025-12094
Summary of CVE-2025-12094 (WordPress OOPSpam Anti-Spam plugin) : The WordPress plugin is vulnerable to IP header spoofing due to trusting client-controlled forwarded headers (e.g., CF-Connecting-IP, X-Forwarded-For) without verifying their provenance. This affects all versions up to and including...
CVE-2025-12094 OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing
The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...
EUVD-2025-37225
Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...
PT-2025-44591
Name of the Vulnerable Software and Affected Versions OOPSpam Anti-Spam plugin for WordPress versions through 1.2.53 Description The OOPSpam Anti-Spam plugin for WordPress is susceptible to IP Header Spoofing. The plugin improperly trusts client-controlled forwarded headers, such as...
CVE-2025-34249
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425...
CVE-2025-34249
...
CVE-2025-34249
CVE-2025-34249 relates to Nagios Fusion prior to 2024R2.1 and describes a brute-force bypass of the 2FA implementation due to inadequate rate limiting/account lockout, enabling repeated second-factor attempts and potential authentication compromise. Red Hat and ENISA references corroborate a 2FA ...
PT-2025-44461
Name of the Vulnerable Software and Affected Versions Nagios Fusion versions prior to 2024R2.1 Description The application lacks proper rate limiting or account lockout mechanisms for repeated failed Two-Factor Authentication 2FA verification attempts. This allows a remote attacker to repeatedly...
GHSA-XRW9-R35X-X878 Zitadel allows brute-forcing authentication factors
Summary A vulnerability in Zitadel allowed brute-force attack on OTP, TOTP and password allowing to impersonate the attacked user. Impact An attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like...
UBUNTU-CVE-2025-40034
In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aerratelimit When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn't advertise an AER...