U.S. Dept Of Defense: IDOR leads to Leakage an ██████████ Login Information

Hi security team, According to my report 1092618, The VDP team agreed that █████████ and it's subdomains is in the scope of the DoD program I continue testing that domain . . Issue Description: There is an IDOR in██████.███████ that connected with ████████.███████ highly protected encryption chat...

Weblate: Race Condition allows to get more free trials and get more than 100 languages and strings for free

Hi there, As there is rate limit in the website, but it doesn't prevent users to take more than 1 trial which later leads to loss of the company, because by getting more trials I can get more strings and languages limit. Steps to reproduce: 1 Create an account on https://hosted.weblate.org and...

Discourse has an unspecified vulnerability (CNVD-2021-100598)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse 2.7.0, which stems from 2FA's reliance on certain forms rate-limit.No details of the vulnerability are currently available...

CVE-2021-1350

A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulnerability exists due to insufficient rate limiting controls in the web UI. An attacker could exploit this vulnerability by sending crafted...

Code injection

A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulnerability exists due to insufficient rate limiting controls in the web UI. An attacker could exploit this vulnerability by sending crafted...

CVE-2021-1350 Cisco Umbrella Dashboard Packet Flood Vulnerability

A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulnerability exists due to insufficient rate limiting controls in the web UI. An attacker could exploit this vulnerability by sending crafted...

CVE-2021-1350 Cisco Umbrella Dashboard Packet Flood Vulnerability

A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulnerability exists due to insufficient rate limiting controls in the web UI. An attacker could exploit this vulnerability by sending crafted...

Cisco Umbrella Dashboard Packet Flood Vulnerability

A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulnerability exists due to insufficient rate limiting controls in the web UI. An attacker could exploit this vulnerability by sending crafted...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

Authentication flaw

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

CVE-2021-3138 affects Discourse 2.7.0 through beta1, where a rate-limit bypass enables bypassing the 2FA requirement for certain forms. The vulnerability stems from how 2FA relies on rate-limiting, enabling bypasses under certain conditions. Documented impact is the 2FA bypass; exploitation detai...

PT-2021-19276 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.7.0 through beta1 Description: A rate-limit bypass issue leads to a bypass of the 2FA requirement for certain forms. Recommendations: For versions 2.7.0 through beta1, update to a version that includes a fix for the...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse 2.7.0, which stems from 2FA's reliance on certain forms rate-limit.No details of the vulnerability are currently available...

Unbreakable Enterprise kernel security update

4.14.35-2025.404.1.1 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch SeongJae Par...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.404.1.1.el7 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1.el7 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch...

TikTok: Lack of rate limitation on careers site allows the attacker to brute force the verification code

An attacker could have potentially attempted to brute force the verification code needed to reset a candidate's password by leveraging a lack of rate limiting on the TikTok careers portal. We thank @iambouali for reporting this to our team and confirming the resolution...

USN-4680-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that debugfs in the Linux kernel as used by blktrace contained a use-after-free in some situations. A privileged local attacker could possibly use this to cause a denial of service system crash. CVE-2019-19770 It was discovered that a race condition existed in the binder IPC...