5816 matches found
Chamberlain myQ 安全漏洞
Chamberlain myQ is an intelligent vehicle access system from Chamberlain. A security vulnerability exists in Chamberlain myQ version v5.222.0.32277 iOS that stems from a lack of rate limiting in the password reset endpoint, which can be exploited by an attacker to compromise a user's account via ...
CVE-2023-24080
A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 on iOS allows attackers to compromise user accounts via a bruteforce attack...
CVE-2023-24080
A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 on iOS allows attackers to compromise user accounts via a bruteforce attack...
CVE-2023-24080
Affected product: Chamberlain myQ (iOS) v5.222.0.32277. Root cause: lack of rate limiting on the password reset endpoint. Impact: enables brute-force attacks to compromise user accounts. Remediation: implement rate limiting and apply available patch; some sources also suggest disabling the passwo...
Nextcloud: Basic auth header on WebDAV requests is not bruteforce protected
A basic authentication bypass vulnerability was discovered on WebDAV requests, due to a lack of rate limit protection. Attackers could brute force the password and gain full account takeover. The vulnerability was reported and fixed...
Mitigation of M-05: Issue not fully mitigated
Lines of code Vulnerability details Original issue: M-05: early user can call issue and then melt to increase basketsNeeded to supply ratio to its maximum value and then melt won't work and contract contract features like issue won't work Not mitigated - attacker can still manipulate the...
The vulnerability of the component responsible for creating new account records in the Apex-VUZ education automation system allows a perpetrator to cause service interruptions.
The vulnerability of the component responsible for creating new account records in the Apex-VUZ automation system is related to improper control of the interaction frequency. Exploiting this vulnerability allows a malicious actor to trigger a service failure by sending specially crafted POST...
GHSA-7968-H4M4-GHM9 No protection against brute-force attacks on login page
Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page. Patches Users should upgrade to v12.0 or later. Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx...
No protection against brute-force attacks on login page
Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page. Patches Users should upgrade to v12.0 or later. Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx...
Denial of service vulnerability on Password reset page
Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may...
GHSA-7J9H-3JXF-3VRF Denial of service vulnerability on Password reset page
Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may...
CVE-2023-25171
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users...
CVE-2023-25156
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a...
Code injection
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a...
Code injection
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users...
SUSE CVE-2012-1107
The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service application crash via a crafted sampleRate in an ape file, which triggers a divide-by-zero error...
SUSE CVE-2013-4369
The xluvifparserate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service NULL pointer dereference by using the "@" character as the VIF rate configuration...
SUSE CVE-2013-5661
Cache Poisoning issue exists in DNS Response Rate Limiting...
SUSE CVE-2014-1542
Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate...