A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8228.json"