Design/Logic Flaw

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

CVE-2018-18531 involves kaptcha 2.3.2, where files text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java use Random instead of SecureRandom to generate CAPTCHA values. This weak randomness can enable remote attackers to brute-forc...

cn.hutool:hutool-aop (>=4.0.0 <=4.1.11), cn.hutool:hutool-bloomFilter (>=4.0.0 <=4.1.11) +79 more potentially affected by CVE-2018-17297 via cn.hutool:hutool-core (>=4.0.0 <=4.1.11)

cn.hutool:hutool-core MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.11 and more Source cves: CVE-2018-17297 Source advisory: OSV:GHSA-RHQ2-2574-78MC...

LG SuperSign CMS Authentication Bypass Vulnerability

LG SuperSign CMS is a content management system for LG webOS from the Luckin LG Group in Korea. The system supports connection to external databases and allows access to the server from mobile devices. An authentication bypass vulnerability exists in LG SuperSign CMS, which can be exploited by an...

Information leakage vulnerability in Dr. Fannie's Broker APP of Guangzhou Live World Network Co.

Dr. Housing Broker - mobile home selling, home price checking, commission checking, showing, customer reporting, customer management, convenient and real. CAPTCHA Information Leakage: This vulnerability mainly occurs when registering and retrieving passwords, the server will return the CAPTCHA to...

Tianjin Jin Yi Fang Network Information Technology Co., Ltd. Yi Fang Network APP has information leakage vulnerability

Bfang.com app is the exclusive software for registered users of Tianjin Bfang.com. Covering a wealth of real estate, houses, high-rise, villas, SOHO, stores. CAPTCHA information leakage: This vulnerability is mainly in the registration, the server will return the verification code to the client,...

Qinhuangdao Kusoft Information Technology Co., Ltd. on Meijia takeout APP has information leakage vulnerability

Shangmeijia focuses on providing online ordering and delivery services of catering food and specialty quality takeout for urban residents. CAPTCHA Information Leakage: This vulnerability mainly occurs when registering and retrieving passwords, the server will return the CAPTCHA to the client, thu...

Authentication flaw

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...

CVE-2018-16286

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...

CVE-2018-16286

LG SuperSign CMS suffers an authentication bypass: if a captcha:pass cookie is present and the PIN is limited to four digits, CAPTCHA is skipped and access can be gained without proper authentication. Multiple sources (NVD/NVD-derived records and CNVD) describe this flaw and its impact; CVSS metr...

There is an information leakage vulnerability in the APP of Beijing JIANNONG Online Information Technology Co.

KANO Online Layer Manager is a national informatization service platform for the egg industry and is a networked production management software platform for egg farms. The application has CAPTCHA information leakage: when registering and retrieving passwords, the server side returns the CAPTCHA t...

Monstra CMS HTTP Header Injection Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An HTTP header injection vulnerability exists in the 'cfg' parameter of the...

Shenzhen Jiya Technology Co., Ltd Jiya APP has information leakage vulnerability

JIYA APP is a cell phone housing search life application that includes new and second-hand housing functions. CAPTCHA Information Leakage: This vulnerability is mainly in the login and password retrieval, the server will return the verification code to the client, thus causing the leakage of...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

Shanghai Pu Ding Culture Communication Co.

Tiger Tour is a self-guided tour service platform founded and operated by Shanghai Purding Culture Communication Co. Ltd. Tiger Tours APP has an SMS bombing vulnerability, the vulnerability stems from the failure of the server side to limit the number of times and time of CAPTCHA requests for the...

WordPress Ajax BootModal Login plugin <= 1.4.3 - CAPTCHA reuse vulnerability

CAPTCHA reuse required only once per user session vulnerability found by Lydéric Lefebvre and Fabien Haureils in WordPress Ajax BootModal Login plugin versions = 1.4.3. Solution 2018.09.01 - we were unable to find a patched version of this plugin...

PHPOKCMS has a logical design flaw

PHPOKCMS is an enterprise station CMS system developed in PHP+MYSQL language. A logical design vulnerability exists in PHPOKCMS. Attackers can log in to other accounts by grabbing packets and blasting CAPTCHA...