CVE-2021-32705

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in...

Code injection

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13,...

Command injection

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in...

CVE-2021-32705

CVE-2021-32705 affects Nextcloud Server: prior to versions 19.0.13, 20.0.11, and 21.0.3 there was no ratelimit on the public DAV endpoint, which could allow an attacker to enumerate potentially valid share tokens or credentials. The issue is fixed in 19.0.13, 20.0.11, and 21.0.3. Impact described...

CVE-2021-32703

Nextcloud Server CVE-2021-32703: The vulnerability is due to a lack of ratelimiting on the shareinfo endpoint, which could allow an attacker to enumerate potentially valid share tokens. Affected versions prior to 19.0.13, 20.0.11, and 21.0.3 are fixed in those respective versions. Remediation is ...

PT-2021-19869 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.13 Nextcloud Server versions prior to 20.0.11 Nextcloud Server versions prior to 21.0.3 Description: The issue is related to a lack of ratelimiting on the "shareinfo" endpoint, which may have allowed an...

PT-2021-19871 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.13 Nextcloud Server versions prior to 20.0.11 Nextcloud Server versions prior to 21.0.3 Description: The issue is related to a lack of ratelimiting on the public DAV endpoint, which may have allowed an...

Ratelimiting can be bypassed using IPv6 subnets

None...

Nextcloud: Ratelimiting can be bypassed using IPv6 subnets

Nextcloud hardcodes IPv6 subnets to /128. End users get at least a /64 subnet more than the whole IPv4 address space!, most providers assign even larger subnets like /48. The subnet is used to block bruteforce attempts 3 and rate limiting 4. An attacker can easily generate random addresses from t...

DRIVE.NET, Inc.: [www.drive2.ru] There is no rate limit for comments endpoints.

The "add comment" endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server and the notification system. Summary The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments,...

Bumble: The login of Hotor Not is Vulnerable to bruteforce.

I was able to validate that The Login of HotorNot is Vulnerable to BruteForcing . Steps to reproduce: 1. https://hotornot.com/signin 2.Use Burp intruder attack for BruteForcing 3.Send as many requests you want. Fix: Proper mitigation of BruteForcing should be done using Ratelimitng etc...

Faceless: Bruteforce attack in login panel

Your application does not limit login attempts done by a user because there is no ratelimiting at the panel that allows a malicious user to brute passwords...