Vendor
WardPearce
2 known vulnerabilities.
Products
2 results · Clear filters · Feed
-
Medium 6.3
Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Tog…
-
Medium 6.3
Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no at…