No rate limiting on the reset password page will lead to a DOS attack and inbox flooding for any user

Description I can use this attack to take advantage of the reset password confirmation mechanism and send a large number of emails to anyone simply because I know his email address, as well as perform a DoS attack by draining the resources of the SMTP service and the web server. Proof of Concept ...

PT-2022-24062 · Maarch Rm · Maarch Rm

Name of the Vulnerable Software and Affected Versions: Maarch RM version 2.8.3 Description: The issue is related to an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. This could allow an unauthenticated remote attacker to...

MTN Group: No rate limit in OTP code sending

The submission describes a vulnerability in the OTP One-Time Password code sending functionality of the MTN Play website. The vulnerability allows an attacker to send an unlimited number of OTP codes without any rate limiting, potentially flooding the victim's mobile inbox. The vulnerability was...

PT-2022-25180 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS affected versions not specified Description: A problematic issue has been found in WBCE CMS, affecting the function increase attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the...

Low: speex security update

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates. Security Fixes: speex: divide by zero in readsamples via crafted WAV file CVE-2020-23903 For more details about the security issues, including the impact, a CVSS...

GSD-2022-1007376 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate

clk: zynqmp: pll: rectify rate rounding in zynqmppllroundrate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...

GSD-2022-1007224 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate

clk: zynqmp: pll: rectify rate rounding in zynqmppllroundrate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...

GSD-2022-1007015 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate

clk: zynqmp: pll: rectify rate rounding in zynqmppllroundrate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

GSD-2022-1006735 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate

clk: zynqmp: pll: rectify rate rounding in zynqmppllroundrate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-35631 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: The issue concerns a rate rounding problem in the zynqmp pll round rate function of the Linux Kernel, specifically affecting the zynqmp pll. The actual impact and potential for attack have...

PT-2022-34990 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a rate rounding problem in the zynqmp pll round rate function. The actual impact and potential for attack have not been confirmed. Recommendations: For Linux Kernel version...

PT-2022-24970 · Kareadita · Kavita

Name of the Vulnerable Software and Affected Versions: kareadita/kavita versions prior to 0.6.0.3 Description: The issue is related to improper restriction of excessive authentication attempts. This can potentially lead to exploitation. No information is provided about the estimated number of...

Information Disclosure

getkirby/cms is vulnerable to Information Disclosure. The vulnerability is due to Auth.php lack of rate limiting login attempts per email address which allows an attacker to gain sensitive information of existing users...

Volatility update bypassed with small transactions

Lines of code Vulnerability details Impact Volatility, and by extension the fee rate increase due to volatility can be circumvented by starting swaps with a token amount. The volatility is accumulated only at specific intervals, similar to the cumulative number of bins crossed. This is an issue...

Dell SupportAssist Multiple Vulnerabilities (DSA-2022-190)

According to its self-reported version number, the version of Dell SupportAssist Client is affected by multiple vulnerabilities. - SupportAssist Client Consumer version 3.11.1 and prior, SupportAssist Client Commercial version 3.2 and prior, Dell Command | Update, Dell Update, and Alienware Updat...

Design/Logic Flaw

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 inclusive are subject to a timing attack in validation of access tokens due to use of regular string comparison f...

GHSA-X8X2-WC2H-WC48 Missing rate limit on rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0...

GHSA-92GF-P376-6R9R Missing rate limit on rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0...

Missing rate limit on rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0...

CVE-2022-39308 GoCD API authentication of user access tokens subject to timing attack during comparison

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 inclusive are subject to a timing attack in validation of access tokens due to use of regular string comparison f...