Default credentials

A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...

CVE-2022-29701

A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...

CVE-2022-29701

CVE-2022-29701 affects Zammad v5.1.0 where the forgot-password endpoint lacks rate limiting, enabling an attacker to flood reset requests and potentially cause a DoS via大量 generated emails. Root cause: missing rate limiting in the forgot-password flow. Impact: Denial of Service as described in th...

Zammad 安全漏洞

Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of rate limiting in the forgot password feature, which could be exploited by an attacker to potentially cause a denial of service DoS via a...

Cisco Firepower Threat Defense 安全漏洞

Cisco Firepower Threat Defense is a suite of unified software from Cisco that provides next-generation firewall services. The vulnerability stems from incorrect traffic handling when platform limits are reached, and can be exploited to cause a denial-of-service DoS condition by sending high-rate...

Unbreakable Enterprise kernel security update

4.14.35-2047.512.6 - Revert 'rds/ib: recover rds connection from stuck rx path' Rohit Nair Orabug: 34039271 - uek-rpm: update kABI lists for new symbols Saeed Mirzamohammadi Orabug: 33993774 4.14.35-2047.512.5 - netfilter: nftables: initialize registers in nftdochain Pablo Neira Ayuso Orabug:...

CVE-2022-20622

A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service DoS condition. The device may experience a...

APIs Are Here to Stay, so Get in Front of Securing Them

A recent IDC survey reported that 38 percent of organizations identified cybersecurity threats and regulations as the factor having the greatest impact on their technology investment planning over the next two years. The survey also revealed that for organizations taking a digital-first business...

CVE-2022-20678

A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. This vulnerability is due to the incorrect handling of certain TCP segments. An attacker could...

CVE-2022-20622

A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service DoS condition. The device may experience a...

CVE-2022-1067

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting...

CVE-2022-1067

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting...

Authentication flaw

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting...

CVE-2022-1067 ICSMA-22-095-01 LifePoint Informatics Patient Portal

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting...

Take other lender loanTicket without improving any of the loan conditions

Lines of code Vulnerability details Impact Take other lender loanTicket without improving any of the loan conditions Proof of Concept The bug is in NftLoanFacilliator.sol in the function lend link1. && previousInterestRate - previousInterestRate requiredImprovementRate / SCALAR = interestRate, fo...

IBM App Connect Enterprise Certified Container拒绝服务漏洞

IBM App Connect Enterprise is an operating system from IBM Corporation. IBM App Connect Enterprise combines the existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud-native technology to provide a platform that meets the full integration needs of...

loan amount is unbounded

Lines of code Vulnerability details The lender of a loan can lend an unbounded amount, which the borrower might not be able to pay its interest rate. Proof of Concept Alice wants to borrow 1000 USDC, she creates a loan with a 10% interest rate, and expects to pay 100 USDC after a year. Bob lends...

NonCustodialPSM.mint ignores mint buffer reduced amount, mostly disabling mint rate control

Lines of code Vulnerability details Impact VOLT minting rate control doesn't happen when RateLimited's doPartialAction is true as NonCustodialPSM doesn't use the returned amount value, minting the full amount even when it was reduced by current mint buffer size limitation. There are two issues wi...

NFTLoanFacilitator: Insufficient granularity allows for same-term loans to be accepted

Lines of code Vulnerability details Details & Impact It is possible for the calculated interest rate improvement to be zero if the existing interest rate is low enough ≤ 0.9% with 10% improvement rate. In such cases, lenders can compete to continually buyout each other with the same terms. The...

Borrower may be forced to pay more interest than he expected

Lines of code Vulnerability details Impact Creating a loan with a minimum amount, instead of a fixed/maximum amount may lead to forcing the borrower to pay more interest than he was expecting or hoping for. The user never knows the potential maximum amount he will need to pay, until the loan is...