CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-13983

Directus 7 API before 2.2.2 is affected by insufficient anti-automation due to lack of CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php. This creates a risk of automated login attempts (brute force). The evidence across multiple sources confirms the vulnerability in Direct...

Kartpay: Captcha protection Bypass on Forgot password page

The Captcha system was implemented by Validation of Captcha was missed out during the forgot password. so it was found out and fixed has been released to the system. Captcha bypass by removing the token and forward the response...

Protection Mechanism Bypass

MantisBT is vulnerable to protection mechanism bypass. It leads to the bypass of CAPTCHA protection mechanism since the publickey parameter value is treated as the key to the CAPTCHA answer, demonstrating the attack via entering the publickey value 0 for E4652...

MobOk Malware Hides in Photo Editors on Google Play, Siphons Cash

A powerful money-siphoning malware known as MobOk has been found hiding in seemingly legitimate photo editing apps available on the Google Play store. The Pink Camera and Pink Camera 2 apps, now removed, had been installed around 10,000 times, according to researchers at Kaspersky. They included...

ADC AAA ReCaptcha fails with error at login page after upgrade or initial setup with "Error for site owner: Invalid Site Key"

Upgrade from 12.1.49.x to 50.x+ or 13.x re-captcha causes error at login page. Setup for ReCaptcha on 12.1.50.x + or 13.0.x causes error at login page. Error on login is "Error for site owner: Invalid Site Key" ns.log has error message - 0-PPE-2: default AAATM Message 16977 0: "nFactor: Could not...

WTCMS Denial of Service Vulnerability

WTCMS is a ThinkPHP-based content management system CMS. A denial of service vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to cause a denial of service resource consumption with the help of specially sized captcha images...

CVE-2019-7412

The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values...

Weblate: No Rate On Add Suggest

Hello Description : I have found that there is no limit in the number of requests in place of adding suggest, which may exploit the vulnerability of the attacker to send a large number of suggestions, for example, send a million suggest may lead to cause a problem to the server Steps To Reproduce...

The Collection App has a flawed logic vulnerability

The Library is a digital reading application under the banner of Xiamen Jianpao Library, which is a digital reading platform integrating public welfare network library and one-stop reading service. There are logic flaws in the Library's app that allow attackers to use proxy tools to obtain CAPTCH...

New AI tool aims to make CAPTCHA a thing of the past

By Waqas Text-based options for verification purposes on websites and other digital forums are going to be a thing of the past, that too, pretty soon. So, get ready to identify objects like cars, parks, and storefronts form CAPTCHA image grids. CAPTCHA is the abbreviation for Completely Automated...

Janusec Application Gateway - Tool Which Provides WAF, CC Attack Defense, Unified Web Administration Portal, Private Key Protection, Web Routing And Scalable Load Balancing

Janusec Application Gateway, an application security solutions which provides WAF Web Application Firewall, unified web administration portal, private key protection, web routing and scalable load balancing. With Janusec, you can build secure and scalable applications. Key Features WAF Web...

Smule: Missing Rate Limit in Forgot Password can Lead to email address leakage of all smule accounts

Hello Smule, I have found a vulnerability by which an attacker can get access of all the gmail accounts associated with Smule. The forgot password parameter can be brute forced through which an attacker can get the email address. Steps to Reproduce Enter your email address and for the forgot...

Captcha doesn't work for page preview comment

Steps to reproduce: go to Configuration - Spam Prevention turn on Captcha for everyone create a page with image click the image to preview try to make a comment on the image Expected: User needs to enter the captcha to submit the comment Actual: User can submit the comment without entering the...

Captcha not checked for page creation

Steps to reproduce: Turn on Captcha from Configuration - Spam Prevention Select "No one everyone will see captchas" and save Create a page should see the captcha Publish the page without entering the captcha Expected: Publish is not allowed Actual: Page is published...

Pagoda Linux panel cross-site scripting vulnerability

Pagoda Linux panel is a Linux hosting panel from China Pagoda Pagoda Network Technology Company. A cross-site scripting vulnerability exists in Pagoda Linux panel version 6.0. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML via a CAPTCHA associated...

GHSA-8Q89-PWHH-7WFQ Use of Insufficiently Random Values in penggle:kaptcha

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

Design/Logic Flaw

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...