Radancy: [www.werkenbijderet.nl] There is no rate limit for vacature-alert endpoints

https://werkenbijderet.nl/vacature-alert lacked a properly configured application specific tuned rate limiting defense mechanism. Because the speed limit was set very high, it was possible to send thousands of mails within 10 minutes. The fix was to implement a middleware which throttles requests...

Huawei Data Communication: Configuring ARP Packet Rate Limiting

After the rate limit for ARP packets is configured, the device counts the number of ARP packets. If the number of ARP packets exceeds the configured threshold within a certain period, the device does not process the excess ARP packets. Copyright C 2020 Greenbone Networks GmbH Some text descriptio...

Huawei Data Communication: Configuring Rate Limit for ARP Miss Messages

After rate limit for ARP Miss messages is configured, the device counts the number of ARP Miss messages. If the number of ARP Miss messages exceeds the threshold, the device does not process the excess ARP Miss messages. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be...

wawpack: Infinite loop in WavpackPackInit function lead to DoS

The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource exhaustion caused by an infinite loop via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero...

wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

Malicious USB Drives Infect 35,000 Computers With Crypto-Mining Botnet

Cybersecurity researchers from ESET on Thursday said they took down a portion of a malware botnet comprising at least 35,000 compromised Windows systems that attackers were secretly using to mine Monero cryptocurrency. The botnet, named "VictoryGate," has been active since May 2019, with infectio...

Stripo Inc: [www.stripo.email] There is no rate limit for /it/contact-us/ endpoints

The speed limit for the https://stripo.email/it/contact-us endpoint has not been implemented...

Stripo Inc: [www.stripo.email] There is no rate limit for contact-us endpoints

Summary The speed limit for the https://stripo.email/es/contact-us endpoint has not been implemented. Steps To Reproduce 1. Go to the https://stripo.email/es/contact-us 2. Turn on blocking and fill out the contact form 3. Send request to Intruder. 4. Set your payloads and start attack. 5. There i...

Brave Software: No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.org

There is no bruteforce protection here https://publishers.basicattentiontoken.org/publishers when i try to changes email's contact account. Also the actual thing is when I put an existing email in the above url's "publisherpendingemail" parameter I get an error response status 400 Bad Request But...

Malicious Package

Overview rate-beer is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using rate-beer...

U.S. Dept Of Defense: Members Personal Information Leak Due to IDOR

Summary https://██████ allows anyone to sign up and view other members profile. According to wikipedia, ███████ is part of US DoD "████████": ██████ I signed up with a regular account and noticed that by referencing users ████, I can send thousands of "█████████" and also, using another end-point...

Juniper Networks Junos OS Evolved Denial of Service Vulnerability

Juniper Networks Junos OS is a Juniper Networks network operating system designed for use with Juniper Networks hardware devices. The operating system provides a secure programming interface and the Junos SDK.Junos OS Evolved is an upgraded version of Junos OS. A security vulnerability exists in...

CVE-2020-11650

An issue was discovered in iXsystems FreeNAS and TrueNAS 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent...

Authentication flaw

An issue was discovered in iXsystems FreeNAS and TrueNAS 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent...

CVE-2020-11650

An issue was discovered in iXsystems FreeNAS and TrueNAS 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent...

CVE-2018-19840

The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource exhaustion caused by an infinite loop via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero...

CVE-2020-1626

A vulnerability in Juniper Networks Junos OS Evolved may allow an attacker to cause a Denial of Service DoS by sending a high rate of specific packets to the device, resulting in a pfemand process crash. The pfemand process is responsible for packet forwarding on the device. By continuously sendi...

Authentication flaw

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence...

CVE-2019-11498

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

PT-2020-20310 · Intuit · Argo Api

Name of the Vulnerable Software and Affected Versions: Argo API version 1.5.0 Description: The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures, allowing attackers to submit an unlimited number of authentication attemp...