Courier: 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )

A vulnerability with AWS API Gateway was uncovered that allowed rate limiting to be bypassed when the X-Forwarded-For headed was manipulated a string added to the header key I was able to bypass the rate limit by adding extra space before the colon X-Forwarded-For: 127.0.0.1. The actual bug was i...

Unspecified Vulnerability in InvoicePlane

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...

Reddit: No rate limit leads to spaming post

Vulnerability description not provided...

in koel/koel

✍️ Description Koel is lacking any form of rate limiting in the login form, thus allowing an attacker to brute force their way in. 🕵️‍♂️ Proof of Concept - Spin up an instance of Koel. - Open up burpsuite and capture a login request, send it to intruder, set your options and run. - 401 is shown...

Reddit: No Rate Limit on redditgifts gift when Adding Comment

Hi team, I hope this report should not be closed as INFORMATIVE Summary: The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server . Description: The add comment endpoint has a speed limit, but the number is set to...

Incompatability with deflationary / fee-on-transfer tokens

Handle cmichel Vulnerability details Vulnerability Details The DInterest.deposit function takes a depositAmount parameter but this parameter is not the actual transferred amount for fee-on-transfer / deflationary or other rebasing tokens. Impact The actual deposited amount might be lower than the...

OPENSUSE-SU-2021:0751-1 Security update for prosody

This update for prosody fixes the following issues: prosody was updated to 0.11.9: Security: modlimits, prosody.cfg.lua: Enable rate limits by default certmanager: Disable renegotiation by default modproxy65: Restrict access to local c2s connections by default util.startup: Set more aggressive...

Security update for prosody (important)

openSUSE Security Update: Security update for prosody Announcement ID: openSUSE-SU-2021:0751-1 Rating: important References: 1186027 Cross-References: CVE-2021-32917 CVE-2021-32918 CVE-2021-32919 CVE-2021-32920 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes four...

CVE-2021-29023

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

Design/Logic Flaw

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

CVE-2021-29023

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

PT-2021-18027 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11 Description: The issue concerns a lack of rate-limiting for password reset and the use of a weak mechanism to generate reset tokens, making them predictable. Recommendations: For InvoicePlane version 1.5.11, consid...

CVE-2021-29023

InvoicePlane 1.5.11 is affected by a vulnerability where there is no rate limiting for password resets and the reset token is generated by a weak, predictable mechanism. Affected component is the password reset flow within InvoicePlane; root cause is lack of rate-limiting and weak token generatio...

InvoicePlane 安全漏洞

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...

openSUSE: Security Advisory for prosody (openSUSE-SU-2021:0728-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:0728-1 Security update for prosody

This update for prosody fixes the following issues: prosody was updated to 0.11.9: Security: modlimits, prosody.cfg.lua: Enable rate limits by default certmanager: Disable renegotiation by default modproxy65: Restrict access to local c2s connections by default util.startup: Set more aggressive...

Sifchain: No Rate Limit protection in user subscription form

Summary: Hello I found your form that user can subscribe for any update has no rate limit protection. Step to reproduce 1. Visit http://sifchain.finance and move to subscribe form and enter email 2. click on sign-up button. 3. use burpsuite to intercept the request and send to intruder. 4. Clear...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2024-11100 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to an error pointer dereference in the mcp251xfd probe function. When the code was converted to use dev err probe, a return was accidentally removed. This leads to...

Valve: Buffer overrun in Steam SILK voice decoder

Vulnerability The SteamWorks SDK has a function available named DecompressVoice, which takes as input some compressed voice data, and returns the raw audio data. The format for the input voice data is as follows: 8 bytes - steamid 1 byte - payload type 2 bytes - payload size 4 bytes - CRC checksu...