5348 matches found
CVE-2020-12645
CVE-2020-12645 affects OX App Suite 7.10.1–7.10.3. The root cause is improper input validation for rate limits, manifested via crafted User-Agent headers, spoofed vacation notices, and memory consumption in /apps/load. Documented impact is memory/resource exhaustion with potential service impact,...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
X (Formerly Twitter): Bypass Password Authentication to Update the Password
Summary:This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to change the victim's...
Yelp: Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting
Summary: Hello everyone, The feature to invite users to manage your business has no rate limiting or captcha implemented. Therefore, a malicious user can use this to mail bomb any email's inbox with invitation requests. Platforms Affected: biz.yelp.com Steps To Reproduce: This is a pretty straigh...
Missing rate limit on signup page (NC-SA-2020-033)
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...
Zoom Flaw Could Have Allowed Hackers To Crack Meeting Passcodes
A security issue in popular video conferencing platform Zoom was disclosed this week, which could have allowed attackers to crack private meeting passcodes and snoop in on video conferences. The problem, which has already been fixed, stems from Zoom not having any check against repeated incorrect...
Zoom Bug Allowed Snoopers Crack Private Meeting Passwords in Minutes
Popular video conferencing app Zoom recently fixed a new security flaw that could have allowed potential attackers to crack the numeric passcode used to secure private meetings on the platform and snoop on participants. Zoom meetings are by default protected by a six-digit numeric password, but...
Courier: Bypass Too Many Requests Sign Up
Courier makes a rate limit check before allowing a user to register; this rate limit check can be bypassed and a user account can be created by sending a request directly to the AWS Cognito API – which is not rate limited...
Huawei Data Communication: Configuring Rate Limiting for ARP Packets (Deprecated)
This VT has been deprecated and replaced by the following VT: - SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Nextcloud: No rate limiting on sinup page
Hi Team, Summary: As a best practice a login page should have a rate limiting. Below is the captured request of respective login page of nextcloud.com -------------------------------------------------------------------------------------------------------------------- POST...
Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager
RCE-CVE-2020-5902 BIG-IP F5 Remote Code Execution Descripti...
Leadtools Image Parser Animated Icon Code Execution Vulnerability
Summary An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted ANI file can cause a buffer overflow resulting in remote code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions Leadtools ...
Clario: No rate Limit on Licenses Activation
Introduction A little bit about Rate Limit A rate-limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time-frame, HTTP-Servers can respond with status code 429...
TikTok: Rate limiting on report video
Rate limiting was not in place for the "report video" option on TikTok web. We thank @alertjd for reporting this to our team...
Automattic: No Rate Limit when accessing "Password protection" enabled surveys leads to bypassing passwords via "pd-pass_surveyid" cookie
Summary: Hi team, If you write the right password on any password protected survey, you will see this request : F878934 This request is protected with rate limit, that's great. But if you look to response, you will see a cookie. The password protection feature is cookie-based system. In my survey...
Courier: Missing rate limit in signup Form
Hello Team , Description When signing up for an account, you enter your email. When this email is already in use, the server responds with "UserConfirmed":true,"UserSub":"ae294fff-6d55-407d-9676-1f3518029037" This in not a problem, but the fact that you could send this request unlimited times is...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-52025)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.2.0, prior to 4.1.1, and prior to 4.0.5, which stems from the program not properly handling IP-based rate limiting. An attack...
Smule: No Rate Limiting On Phone Number Login Leads to Login Bypass
Hey Team, Introduction: A rate limiting algorithm is used to check if the user session has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame. Description: I was able to Bypass Authentication of any user by enumerating th...
