Froxlor vulnerable to Allocation of Resources Without Limits or Throttling

Froxlor prior to 2.0.16 has a password reset page with no rate limit...

GHSA-4GM9-C9JQ-G523 Froxlor vulnerable to Allocation of Resources Without Limits or Throttling

Froxlor prior to 2.0.16 has a password reset page with no rate limit...

Mozilla: If rate limit is hit, IP address is leaked to anyone who tries to login

The rate limit on the login page of Bugzilla allowed the IP address of a user to be leaked to anyone attempting to login after the rate limit was hit...

Rate-limit Bypass

azuracast/azuracast is vulnerable to rate-limit Bypass. The vulnerability exists due to a lack of user request rate limiting when the request headers include random values, which allows an attacker to bypass the login security mechanism...

Comptroller.exitMarket() does not get an updated exchange rate causing inacurate exit validations

Lines of code Vulnerability details Impact The user can use the exitMarket function to remove an asset from the account liquidity calculation; disabling them as collateral. The problem is that the user can call exitMarket before the vToken updates their accrue interests via accrueInterest functio...

Inflation attack by drip

Lines of code Vulnerability details Impact The drip might inflate the exchange rate on an initial stake such that that subsequent stakers get minted zero wxETH. Their stake can then be unstaked by the first staker, together with their own first stake and inflation investment. Effectively, the fir...

Virgin stake can claim all drops

Lines of code Vulnerability details Impact If wxETH drips when nothing is staked, then the first staker can claim every drop. Proof of Concept Suppose drip is enabled when totalSupply == 0. At least one block passes and the first staker stakes, just 1 xETH is enough. This mints her 1 wxETH. This...

When borrowRateMantissa is higher than the limit value, VToken contract will be DOS

Lines of code Vulnerability details Impact File: VToken.sol 678 function accrueInterest public virtual override returns uint256 --skip-- 695 uint256 borrowRateMantissa = interestRateModel.getBorrowRatecashPrior, borrowsPrior, reservesPrior; 696 requireborrowRateMantissa borrowRateMaxMantissa. Thi...

Wrong WhitePaperInterestRateModel block per year calculations incur losses for users and the protocol

Lines of code Vulnerability details Vulnerability Details Blocks per year calculations in WhitePaperInterestRateModel improperly assume 15 seconds block time, while on Binance Smart Chain it’s 3 seconds. This has grave consequences, because it is used in calculating borrower’s interest rate and...

kernel: net/sched: sch_taprio: fix possible use-after-free

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: fix possible use-after-free syzbot reported a nasty crash 1 in nettxaction which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCARATE attribute...

kernel: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration

In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211getrateduration Fix possible out-of-bound access in ieee80211getrateduration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in...

PT-2025-13367 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A use-after-free issue has been identified in the Linux kernel, specifically in the sch taprio component. This issue occurs when a taprio qdisc is installed with an invalid TCA RAT...

Mitigation of M-08: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-08: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings685 Comments First, there is a clear error in the associated description of mitigation: "Use Chainlink to get rETH". Using Chainlink to obtain the...

PT-2023-20023 · Azuracast · Azuracast

Name of the Vulnerable Software and Affected Versions: AzuraCast versions prior to 0.18.3 Description: The issue is related to improper restriction of excessive authentication attempts in the AzuraCast GitHub repository. Specifically, the request rate limiting feature on the login page can be...

CLSA-2023-1683146027 kernel: Fix of 23 CVEs

media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - net: mpls: fix stale pointer if allocation fails during device rename CVE-2023-26545 - net/ulp: prevent ULP without clone op from entering the LISTEN status CVE-2023-0461 - Bluetooth: L2CAP: Fix u8 overflow CVE-2022-45934 -...

No rate limit on send report functionality results in an email spam

Description There is no rate limit on the send report feature on the https://rdiffweb-dev.ikus-soft.com/prefs/notification endpoint , which allows an attacker to spam the victims mailbox Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/notification 2 Click on daily frequency for...

CVE-2023-2378

A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument suffix-rate-up leads to command injection. The attack may be...

Missing rate limit for password resets

Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...

CVE-2023-28821

Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...

Default credentials

Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...