Common Weakness Enumeration
CWE-799
Allowed-with-ReviewImproper Control of Interaction Frequency
Abstraction: Class · Status: Incomplete
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
124 vulnerabilities reference this CWE, most recent first.
GHSA-P77M-F595-QX5V
Vulnerability from github – Published: 2023-07-12 15:30 – Updated: 2024-04-04 06:04
VLAI
Details
In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-38068"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-12T13:15:09Z",
"severity": "HIGH"
},
"details": "In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms",
"id": "GHSA-p77m-f595-qx5v",
"modified": "2024-04-04T06:04:11Z",
"published": "2023-07-12T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38068"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PW23-46F3-853X
Vulnerability from github – Published: 2025-05-20 18:30 – Updated: 2025-05-20 18:30
VLAI
Details
OpenFlow discovery protocol can exhaust resources because it is not rate limited
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48016"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-20T16:15:35Z",
"severity": "MODERATE"
},
"details": "OpenFlow discovery protocol can exhaust resources because it is not rate limited",
"id": "GHSA-pw23-46f3-853x",
"modified": "2025-05-20T18:30:57Z",
"published": "2025-05-20T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48016"
},
{
"type": "WEB",
"url": "https://selinc.com/products/software/latest-software-versions"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QCC3-JQWP-5VH2
Vulnerability from github – Published: 2026-04-02 21:01 – Updated: 2026-05-06 23:24
VLAI
Summary
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification
Details
Summary
LINE webhook handler lacks shared pre-auth concurrency budget before signature verification
Current Maintainer Triage
- Status: open
- Normalized severity: low
- Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
57c47d8c7fbf5a2e70cc4dec2380977968903cad— 2026-03-31T19:34:25+09:00
OpenClaw thanks @nexrin for reporting.
Severity
5.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.28"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41343"
],
"database_specific": {
"cwe_ids": [
"CWE-770",
"CWE-799"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-02T21:01:08Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nLINE webhook handler lacks shared pre-auth concurrency budget before signature verification\n\n## Current Maintainer Triage\n- Status: open\n- Normalized severity: low\n- Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.28`\n- Patched versions: `\u003e= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `57c47d8c7fbf5a2e70cc4dec2380977968903cad` \u2014 2026-03-31T19:34:25+09:00\n\nOpenClaw thanks @nexrin for reporting.",
"id": "GHSA-qcc3-jqwp-5vh2",
"modified": "2026-05-06T23:24:58Z",
"published": "2026-04-02T21:01:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41343"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/57c47d8c7fbf5a2e70cc4dec2380977968903cad"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-line-webhook-handler-pre-auth-concurrency"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification"
}
GHSA-QRF6-H5FC-7M96
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2025-10-22 19:47
VLAI
Summary
Mattermost Server does not enforce rate limits on password change attempts
Details
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-11069"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-22T19:47:35Z",
"nvd_published_at": "2020-06-19T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.",
"id": "GHSA-qrf6-h5fc-7m96",
"modified": "2025-10-22T19:47:35Z",
"published": "2022-05-24T17:21:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-11069"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/c976c2881ce5e34febac8a9850a6bad5d728625e"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Server does not enforce rate limits on password change attempts"
}
GHSA-R37H-J483-CJJM
Vulnerability from github – Published: 2021-06-01 21:38 – Updated: 2021-06-04 18:50
VLAI
Summary
Improper rate limiting in Koel
Details
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phanan/koel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-33563"
],
"database_specific": {
"cwe_ids": [
"CWE-799",
"CWE-916"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-01T20:37:37Z",
"nvd_published_at": "2021-05-24T23:15:00Z",
"severity": "HIGH"
},
"details": "Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.",
"id": "GHSA-r37h-j483-cjjm",
"modified": "2021-06-04T18:50:20Z",
"published": "2021-06-01T21:38:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33563"
},
{
"type": "WEB",
"url": "https://github.com/koel/koel/releases/tag/v5.1.4"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/1-other-koel/koel"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper rate limiting in Koel"
}
GHSA-RCJQ-RRM8-5G33
Vulnerability from github – Published: 2024-06-04 09:30 – Updated: 2025-04-03 00:31
VLAI
Details
Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-40332"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-04T08:15:09Z",
"severity": "MODERATE"
},
"details": "Improper Control of Interaction Frequency vulnerability in Lester \u2018GaMerZ\u2019 Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.",
"id": "GHSA-rcjq-rrm8-5g33",
"modified": "2025-04-03T00:31:30Z",
"published": "2024-06-04T09:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40332"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-91-rating-limit-bypass-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RFH8-HGH4-42Q6
Vulnerability from github – Published: 2024-06-14 00:33 – Updated: 2024-06-14 00:33
VLAI
Details
NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction frequency in the host. A successful exploit of this vulnerability might lead to denial of service.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-0094"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-13T22:15:13Z",
"severity": "MODERATE"
},
"details": "NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction frequency in the host. A successful exploit of this vulnerability might lead to denial of service.",
"id": "GHSA-rfh8-hgh4-42q6",
"modified": "2024-06-14T00:33:07Z",
"published": "2024-06-14T00:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0094"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5551"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RJ42-V997-M6XJ
Vulnerability from github – Published: 2026-03-26 15:30 – Updated: 2026-03-26 15:30
VLAI
Details
HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and processing resources which may lead to Denial of Service.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-55268"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-26T13:16:26Z",
"severity": "MODERATE"
},
"details": "HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and processing resources which may lead to Denial of Service.",
"id": "GHSA-rj42-v997-m6xj",
"modified": "2026-03-26T15:30:38Z",
"published": "2026-03-26T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55268"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0129793"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-RQR4-MC25-2CVQ
Vulnerability from github – Published: 2024-06-21 00:33 – Updated: 2025-07-30 18:31
VLAI
Details
An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-35246"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T23:15:52Z",
"severity": "HIGH"
},
"details": "An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.",
"id": "GHSA-rqr4-mc25-2cvq",
"modified": "2025-07-30T18:31:26Z",
"published": "2024-06-21T00:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35246"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-172-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VP6F-F84F-RM77
Vulnerability from github – Published: 2024-06-04 09:30 – Updated: 2024-06-04 09:30
VLAI
Details
: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-40673"
],
"database_specific": {
"cwe_ids": [
"CWE-799"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-04T08:15:09Z",
"severity": "MODERATE"
},
"details": ": Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.",
"id": "GHSA-vp6f-f84f-rm77",
"modified": "2024-06-04T09:30:57Z",
"published": "2024-06-04T09:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40673"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/cartpauj-register-captcha/wordpress-cartpauj-register-captcha-plugin-1-0-02-captcha-bypass-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.