Rate Limiting Bypass in express-brute

All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...

7ghost (>=4.11.0, <=4.11.46), @agneta/platform (>=0.16.9, <=0.17.0) +68 more potentially affected by unknown CVE via express-brute (>=1.0.0, <=1.0.1)

express-brute NPM version =1.0.0, =4.11.0, =0.16.9, =0.0.2-publish-module-10a23dea78e8b2ead9b62883b97c62fe5e838b4d, =3.1.0-beta.9, =0.0.1, =1.0.0-0, =1.3.3, =1.0.0, =1.1.0, =3.41.6, =1.0.1, =1.1.42, =1.2.15 and more Source cves: unknown CVE Source advisory: OSV:GHSA-984P-XQ9M-4RJW...

How Carbon Black is Prioritizing Living Off the Land Attacks

What are Living Off the Land LoL Attacks? In recent years, Living off the Land Binaries and Scripts LOLBas have become increasingly popular tools for cybercriminals. These types of attacks leverage native, signed, and often pre-installed applications in malicious ways that their creators never...

EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1557)

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that ntpd did not check whether a Message Authentication Code MAC was present in a received packet when ntpd was...

CVE-2018-15462

A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a denial of service DoS condition...

CVE-2018-15462

A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a denial of service DoS condition...

Cisco Firepower Threat Defense Software TCP Ingress Handler Denial of Service Vulnerability

A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a denial of service DoS condition...

DEBIAN-CVE-2019-11498

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

ALPINE-CVE-2019-11498

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

CVE-2019-11498

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

UBUNTU-CVE-2019-11498

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

FreeBSD : Istio -- Security vulnerabilities (484d3f5e-653a-11e9-b0e3-1c39475b9f84)

Istio reports : Two security vulnerabilities have recently been identified in the Envoy proxy. The vulnerabilities are centered on the fact that Envoy did not normalize HTTP URI paths and did not fully validate HTTP/1.1 header values. These vulnerabilities impact Istio features that rely on Envoy...

Rate Limiting Bypass

Overview All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...

CVE-2019-1718 Cisco Identity Services Engine SSL Renegotiation Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service DoS condition. The vulnerability is due to improper handling of Secure Sockets Layer SSL renegotiation requests. A...

WordPress Limit Login Attempts Reloaded 2.7.4 Bypass Exploit

WordPress Limit Login Attempts Reloaded plugin version 2.7.4 suffers from a login limit bypass vulnerability. !/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link:...

WordPress Limit Login Attempts Reloaded 2.7.4 Bypass

!/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded Version: 2.7.4 Tested on: WordPress 5.1.1 Descriptio...

WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass

WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass !/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link:...

WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass

!/usr/bin/env node const request = require"request" / Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass Date: 2019-04-08 Exploit Author: isdampe Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded Version: 2.7.4 Tested on: WordPress 5.1.1 Descriptio...

USN-3933-1 linux vulnerabilities

It was discovered that an information leak vulnerability existed in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could possibly expose sensitive information kernel memory. CVE-2017-1000410 It was discovered that the USB serial device driver in the Linux...

U.S. Dept Of Defense: Email PII disclosure due to Insecure Password Reset field

Summary: I revisited report 235041 and discovered the vulnerability isn't patched properly as I was able to discover more emails I could gleam. It appears the core mechanism allows anyone who knows specific names or user names to leak sensitive emails Description: This password reset field allows...