Lack of Rate Limiting | writeups.xyz

Title	Vulnerabilities	Programs	Authors
Unlocking the Weak Spot: Exploiting Insecure Password Reset Tokens	Bruteforce Lack of Rate Limiting Password Reset Account Takeover	Undisclosed	Mosaad Sallam (@H0tak88r)
DOS attack possible on Reset 2FA feature of #Hackerone	Application-Level DoS Lack of Rate Limiting	HackerOne	Lokesh Ranjan
My First Un-Expected $$$$ Digit Bounty for an Un-Expected Vulnerability	Lack of Rate Limiting Bruteforce	Undisclosed	Shobhit Mehta
How I became a millionaire in 3h \| Fintech Bug Bounty — Part 1	IDOR Lack of Rate Limiting Logic Flaw	Undisclosed	0x4KD (@0x4kd)
[BAC/IDOR] How my father credit card help me to find this access control issue	IDOR Lack of Rate Limiting	Undisclosed	Xcoder(Joy Ahmed) (@Xcoder074)
My Account Takeover Writeup: $5000	Lack of Rate Limiting Bruteforce	Undisclosed	MRD7 (@_Mrd7_)
GL.iNET GL-MT300N-V2 Router Vulnerabilities and Hardware Teardown	OS Command Injection Arbitrary File Read Information Disclosure Account Takeover Stored XSS Lack of Rate Limiting Weak Credentials Password Policy Bypass	GL.iNet	Olivier Laflamme (@Olivier_boschko)
How I found 3 rare security bug in a day	Session Expiration Issue Payment Bypass Lack of Rate Limiting	Undisclosed	Zer0d
PII Disclosure of Apple Users ($10k)	IDOR Lack of Rate Limiting Bruteforce Information Disclosure	Apple	Ahmad Halabi (@Ahmad_Halabi_)
Exploiting vulnerabilities in iOS Application	IDOR Bruteforce Lack of Rate Limiting Account Takeover IOS	Undisclosed	Raj Singh Chauhan (@Raj_singh_ch)
ATO without any interaction [aws cognito misconfiguration]	Account Takeover Lack of Rate Limiting	GitHub	Shreyaskoli (@SPY8OY)
Rate Limit Bypass at Readme.com	Lack of Rate Limiting Password Reset	Readme.com	Girishbo
What I Found on Sony Vulnerability Disclosure Program	Information Disclosure Lack of Rate Limiting Open Redirect IDOR XSS	Sony	Aditya Singh / Rook1337 (@Imrook1337)
No Rate Limiting on OTP sending	Bruteforce Lack of Rate Limiting	Undisclosed	NOOb_mAsTeR
Missing rate-limiting. How I was able to add any unowned phone number to my Facebook account? (Bounty: 5000 USD)	OTP Bruteforce Lack of Rate Limiting	Meta / Facebook	Shubham Bhamare (@Theshubh77)
How I was able to take over accounts in websites deal with Github as an SSO provider	Bruteforce Lack of Rate Limiting SSO Email Verification Bypass Account Takeover	Undisclosed	Khaled Mohamed
Massive Users Account Takeovers(Chaining Vulnerabilities to IDOR)😲	Authentication Bypass IDOR Lack of Rate Limiting	Undisclosed	Anurag__Verma
How I managed to hack User accounts of a billion-dollar sport platform	OTP Bypass Bruteforce Lack of Rate Limiting	Undisclosed	Vishnuraj
chaining improper authentication to idor and no rate limit for mass account takeover	Account Takeover Lack of Rate Limiting CSRF IDOR	Undisclosed	Mohit (@Mohit29295572)
Unlimited report user in Instagram (Facebook) leads to abuse risk.	Lack of Rate Limiting	Meta / Facebook	Mano Prasanth
10 golden minutes for taking over a Chess.com account	Lack of Rate Limiting Bruteforce Session Expiration Issue	Chess.com	Seqrity (@Seqrity9)
OTP brute-force via rate limit bypass	Bruteforce Lack of Rate Limiting OTP Bypass	Undisclosed	Bilal Muqeet (@Blmqt)
Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli	Race Condition Lack of Rate Limiting OTP Bypass SQL Injection	Undisclosed	Yasser Mohammed (@Boomneroli)
$500 For No Rate Limit On Forgot Password Page	Lack of Rate Limiting Password Reset	Undisclosed	BBHC (@Community_bug)
BMW Bug Bounty – Account Verification Bypass writeup	OTP Bypass Bruteforce Lack of Rate Limiting	BMW	Pethuraj (@Pethuraj)

Page 1 of 3