Nextcloud · Report #199714
Missing Rate Limit for Current Password field in nextcloud.com
Validstatus
lowseverity
8upvotes
20 May 2017disclosed
Summary
There is no rate limit enabled for "Current Password" field on Setting page of nextcloud.com. A malicious minded user can continually tries to brute force an account password.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.