VMware Workspace ONE UEM console DoS (VMSA-2021-0017)

According to its self-reported version, the install of Workspace ONE UEM console running on the remote host is 2001 prior to 20.1.0.33, 2005 prior to 20.5.0.51, 2008 prior to 20.8.0.32, 2011 prior to 20.11.0.30, 2102 prior to 21.2.0.14, or 2105 prior to 21.5.0.2. It is, therefore, affected by...

UPchieve: No rate Limit on Password Reset page on upchieve

Summary: Introduction A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status...

Miner fails to get block template when a cell used as a cell dep has been destroyed.

Impact The RPC getblocktemplate fails when a cell has been used as a cell dep and an input in the different transactions. Say cell C is used as a dep group in the transaction A, and is destroyed in the transaction B. The node adds transaction A first, then B into the transaction pool. They are bo...

in circuitverse/circuitverse

✍️ Description no rate limit allow to send unlimited email to any mail address 🕵️‍♂️ Proof of Concept During forgot password there is no rate limit to send password-reset email which allow to send unlimited email to a mail address. bellow request is vulnerable to rate-limit bug POST /users/password...

UPchieve: No Rate Limit on forgot password page

Summary: no rate limit bug on ur loigin page .. Steps To Reproduce: add details for how we can reproduce the issue 1. add step 1. add step 1. add step Supporting Material/References: list any additional material e.g. screenshots, logs, etc. attachment / reference Recommendations for...

GHSA-M72M-MHQ2-9P6C Uncaught Exception in jsoup

Impact What kind of vulnerability is it? Who is impacted? Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until cancelled, to comple...

Lack of Resources Rate Limiting☝️ — What you need to know

Lack of Resources Rate Limiting☝️ — What you need to know Introduction API4:Lack of Resources Rate Limiting ‍What is Lack of Resources and Rate Limiting? Whenever an API is served a request it will have to respond, to generate this response the API requires resources CPU, RAM, network and at times...

Vmware Workspace One 安全漏洞

Vmware Vmware Workspace One is a platform for supporting cross-device applications for rapid delivery and management of applications from Vmware, USA. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoi...

Vulnerability fixed in BIND

A vulnerability has been fixed in BIND. The vulnerability allows a remote malicious party the ability to cause a denial-of-service cause. The vulnerability manifests itself when the RRL functionality is enabled. By default, this is not case. ISC has released updates to fix and mitigation. More...

CVE-2021-25218

A flaw was found in bind. An assertion failure is triggered, resulting in termination of the named server process, if named attempts to respond over UDP with a response that is larger than the current effective interface maximum transmission unit MTU, and if response-rate limiting RRL is active...

CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

AZL-7253 CVE-2021-37714 affecting package jsoup 1.11.3-3

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

DEBIAN-CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

PT-2021-7917

Name of the Vulnerable Software and Affected Versions jsoup versions prior to 1.14.2 Description The issue is related to the parsing of untrusted HTML or XML, which may cause the parser to get stuck, complete more slowly than usual, or throw an unexpected exception, potentially supporting a denia...

ISC BIND 处理逻辑错误漏洞

ISC BIND is a suite of open source software from ISC that implements the DNS protocol. A Processing Logic Error vulnerability exists in ISC BIND, which originates when named attempts to respond via UDP with a response larger than the currently valid interface's Maximum Transmission Unit MTU and...

Broken User Authentication☝️ — What you need to know

Broken User Authentication☝️ — What you need to know Introduction API2:Broken User Authentication What is Broken User Authentication? Broken User Authentication can manifest in several issues. Whenever we come across an API endpoint that handles authentication we need to be extra careful since...

Insecure Authentication

lincmsflask uses insecure authentication. The vulnerability exists due to a lack of rate-limiting in the login function...

MTN Group: There is no rate limit for SME REGISTRATION PORTAL

Summary: The speed limit for the https://mtngbissau.com/registo/ endpoint has not been implemented. Steps To Reproduce: 1. Go to the https://mtngbissau.com/registo/ 2. fill out the Registration form 3. Send request to Intruder. 4. Set your payloads and start attack. 5. There is no rate-limit...

Staker.sol: Wrong values returned in edge cases of _calculateFloatPerSecond()

Handle hickuphh3 Vulnerability details Impact In calculateFloatPerSecond, the edge cases where full rewards go to either the long or short token returns return 1e18 k longPrice, 0; and return 0, 1e18 k shortPrice; respectively. This is however 1e18 times too large. We can verify this by checking...