5344 matches found
CVE-2017-15266
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTORwavextractmethod in wavextractor.c via a zero sample rate...
CVE-2017-15266
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTORwavextractmethod in wavextractor.c via a zero sample rate...
AWSBucketDump - Security Tool to Look For Interesting Files in S3 Buckets
AWSBucketDump is a tool to quickly enumerate AWS S3 buckets to look for loot. It's similar to a subdomain bruteforcer but is made specifically for S3 buckets and also has some extra features that allow you to grep for delicious files as well as download interesting files if you're not afraid to...
Instacart: Get all instacart emails - missing rate limit on /accounts/register
Hey Instacart team, When signing up for an account, you enter your email. When this email is already in use, the server responds with ""errors":"email":"has already been taken"" This in not a problem, but the fact that you could send this request unlimited times is the issue. This way we can easi...
First Android Malware Found Exploiting Dirty COW Linux Flaw to Gain Root Privileges
Nearly a year after the disclosure of the Dirty COW vulnerability that affected the Linux kernel, cybercriminals have started exploiting the vulnerability against Android users, researchers have warned. Publicly disclosed last year in October, Dirty COW was present in a section of the Linux...
Instacart: Bruteforcing password reset tokens, could lead to account takeover
Hey Instacart security team, Description When resetting a new password on https://shoppers.instacart.com/password you will receive an email with a reset link. when clicking on this link. you go to this page: https://shoppers.instacart.com/password/edit?resetpasswordtoken=YourToken when entering a...
Moneybird: Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure
The rate limit for entering a password to start a secure session was too low. This allowed for brute force password guessing when an attacker would gain access to an existing session of a user. We have solved the issue by making the password rate limit the same as the regular login procedure...
DGA-Detection - DGA Domain Detection using Bigram Frequency Analysis
More and more malware is being created with advanced blocking circumvention techniques. One of the most prevalent techniques being used is the use of Domain Generation Algorithms which periodically generates a set of Domains to contact a C&C server. The majority of these DGA domains generate rand...
The vulnerability of the NTP network time protocol’s speed-limiting service allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Network Time Protocol’s rate-limiting service exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause partial breaches of the confidentiality, integrity, and accessibility of the...
Memory corruption
A vulnerability in the TCP throttling process for Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is due to insufficient...
CVE-2017-6780
A vulnerability in the TCP throttling process for Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is due to insufficient...
Cisco IoT Field Network Director Memory Exhaustion Denial of Service Vulnerability
A vulnerability in the TCP throttling process for Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart. The vulnerability is due to insufficient rate-limiting protection...
WAP-billing Trojan-Clickers on rise
During the preparation of the "IT threat evolution Q2 2017" report I found several common Trojans in the "Top 20 mobile malware programs" list that were stealing money from users using WAP-billing - a form of mobile payment that charges costs directly to the user's mobile phone bill so they don't...
Unikrn: Rate-limit protection get executed in the last stage of the registration process, allowing enumeration of existing account.
Summary: ====== This may be low risk impact but I need to suggest on improvement on your existing rate-limit protection on the registration page, It is an easy workaround and make the current protection more secure. Description: ======== Unikrn increases the registration security by requiring use...
Fuze Patches TPN Handset Vulnerabilties
Fuze, a maker of popular enterprise-grade voice-over-IP handsets, earlier this year patched three vulnerabilities that exposed user account information and enabled unauthorized authentication. The issues were made public today by researchers at Rapid7 who privately disclosed the flaws on April 12...
Facebook Awards $100K to Researchers for Credential Spearphishing Detection Method
A group of researchers recently identified a real-time way to detect credential spearphishing attacks in enterprise settings. The discovery net the researchers $100,000 last week from Facebook, which awards money as part of its annual Internet Defense Prize partnership with USENIX Association. Th...
HTTP Load Generator: hey
hey is a tiny program that sends some load to a web application – ApacheBench ab replacement. hey was originally called boom and was influenced from Tarek Ziade’s tool at tarekziade/boom . Installation go get -u github.com/rakyll/hey Note: Requires go 1.7 or greater. Usage hey runs provided numbe...
CVE-2015-7705
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests...
