Wheeling Self-Driving Android App is vulnerable to arbitrary account password resets

Wheel Self-Driving APP is a self-driving comprehensive service center software. The Rolling Self-Driving Android APP is vulnerable to arbitrary account password reset vulnerability. It allows an attacker to reset any registered account password by means of CAPTCHA blasting...

Denial of Service Vulnerability in Electricity Free Android App

Electricity Worry-free APP is a cross electrical equipment professional service platform. A denial of service vulnerability exists in the Electricity Worry Free Android APP. It allows an attacker to traverse a cell phone number and send unlimited CAPTCHAs to the cell phone, consuming server...

Willow Police App Has Arbitrary Account Login Vulnerability

Liuzhou Police APP is a police information application platform launched by Liuzhou Municipal Public Security Bureau. Liuzhou Police APP has an arbitrary account login vulnerability. By means of CAPTCHA blasting, an attacker can log in to any account through a cell phone number...

CAPTCHA Bypass Vulnerability in FAW-Volkswagen After-Sales Service App Android Version

FAW-VW After-sales Service APP is a software that provides professional after-sales service. Through this software, you can call roadside assistance with one click at anytime and anywhere. The software also provides personal automobile information, online reservation and automobile repair progres...

CAPTCHA Bypass Vulnerability in Genuine Technology APP Android Version

Chuangyuan Technology APP is a collection of intelligent property, intelligent parking, intelligent home, intelligent building control, green energy management and other intelligent park solutions, aiming to create intelligent office experience and life experience for all kinds of users in the pa...

Weblate: No rate limit or captcha to identify humans

Affected URL: https://hosted.weblate.org/hosting/ Issue: There is no captcha or rate limit to protect from bots against adding request for new project hosting. Which makes it easy for an attacker to perform spamming. Shall you need any more info notify me,...

CAPTCHA Bypass

in2code/powermail is vulnerable CAPTCHA bypass. This is possible because the == operator is used to compare if the if code is set and equal to session value...

Design/Logic Flaw

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

CVE-2017-11717

MetInfo CMS up to version 5.3.17 contains a captcha handling flaw: the same CAPTCHA response can be accepted for 120 seconds, enabling remote attackers to bypass challenges by tampering with the client–server data stream (login/findpass page). Affected product is MetInfo; root cause is reuse of a...

MetInfo has a logic flaw

MetInfo is a Content Management System CMS developed using PHP and Mysql. A logic vulnerability exists in MetInfo 5.3.17 and earlier versions. A remote attacker can exploit this vulnerability by changing the data flow between client servers to bypass captcha...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

Session fixation

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 is affected by CVE-2017-7673 due to weak cryptographic storage and missing brute-force protection in authentication-related forms, with registration and password-reset flows lacking captcha. Connected docs confirm the vulnerability details but do not provide a remediatio...

Mail.ru: BruteForce Any [My.com] Account Credentials.

CAPTCHA entered on account.my.com was not actually checked. account.my.com has no relation to My.Com's MyMail and is not currently covered by regular Mail.Ru bug bounty program...

Nanjing Palm Public Transportation APK has CAPTCHA Leakage Vulnerability

Nanjing Palm Bus is jointly created by Nanjing Public Transportation Group Co., Ltd. and Jiangsu Provincial Radio and Television Station Group. It is the only palmtop intelligent integrated service platform in Nanjing that collects real-time bus location inquiry, local news, live mobile TV and...