CVE-2016-8600

dotCMS CAPTCHA bypass vulnerability (CVE-2016-8600) affects dotCMS 3.2.1, where the CAPTCHA code can be reused within the same session: after loading a CAPTCHA, an attacker can submit the form with that correct code for subsequent checks. Root cause: last loaded CAPTCH A code persists in the sess...

TGCaptcha2 Replay Attack Vulnerability

TGCaptcha2 is a suite of tools that provide a reduction in spam or malicious activity by combining CAPTCHAs as a single form. A replay attack vulnerability exists in TGCaptcha2 version 0.3.0. An attacker can exploit the vulnerability to use the same CAPTCHA an unlimited number of times...

Cross-site scripting vulnerability in wordpress plugin contact-form-with-captcha

Contact Form With Captcha is a Wordpress plugin with CAPTCHA plugin Contact Form allows users to access Wordpress blogs using Google CAPTCHA form, it requires PHP 5 or higher. Wordpress plugin contact-form-with-captcha suffers from an xss vulnerability due to improper filtering of user input, whi...

CVE-2016-1000032

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times...

CVE-2016-1000032

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times...

dotCMS CAPTCHA Bypass Vulnerability

Exploit for php platform in category web applications Title: CVE-2016-8600 dotCMS - CAPTCHA bypass by reusing valid code Credit: Elar Lang / https://security.elarlang.eu Vulnerability: CAPTCHA bypass by re-using last loaded valid CAPTCHA code Vulnerable version: before 3.6.0 CVE: CVE-2016-8600...

Ian Dunn: No CAPTCHA ia exist in pages

No CAPTCHA is exist in the "Wordpress-backup-options" and "contact" pages. Due to the fact that the webpage has no CAPTCHA mechanism any attacker can perform DOS/DDOS attack and perform Daniel of Service attack to the server. Links: Wordpress-backup-options page:...

Magento Community Edition 2.x < 2.0.1 Multiple Vulnerabilities

Binary data 9692.prm...

Login CAPTCHA Bypass Vulnerability in AVTECH Device Login Parameter

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. There is a login authentication code bypass vulnerability in the login parameter of AVTECH devices. When the login request...

WordPress All-In-One Security / Firewall 4.1.2 CAPTCHA Bypass

------------------------------------------------------------------------ Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA ------------------------------------------------------------------------ Sipke Mellema, July 2016...

WordPress All In One WP Security and Firewall Plugin Login CAPTCHA Bypass

The login CAPTCHA provided by the WordPress All In One WP Security and Firewall Plugin can be circumvented, allowing attackers to automate login attempts when the CAPTCHA is enabled...

WordPress All In One WP Security & Firewall Plugin <= 4.1.2 - Multiple Vulnerabilities

There are multiple vulnerabilities in in login CAPTCHA. Because of them, attackers can automate login attempts when the CAPTCHA is enabled. Solution Update the plugin...

All In One WP Security & Firewall <= 4.1.2 - Multiple vulnerabilities in login CAPTCHA

The All In One WP Security & Firewall WordPress plugin was affected by a Multiple vulnerabilities in login CAPTCHA security vulnerability...

Securimage 'example_form.ajax.php' cross-site scripting vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA codes.' A cross-site scripting vulnerability exists in Securimage. An attacker can exploit this vulnerability to execute arbitrary script code, steal cookie-based authentication and launch other...

██████: Cross-site request forgery vulnerability resulting in the deletion of a user's account.

One of the first cross-site request forgery vulnerabilities that I discovered on █████ allowed me to delete an unsuspecting user's account. In order to exploit this issue, I crafted a simple HTML form that sent a POST request to the /unregister endpoint when a user loaded the malicious page. html...

Nextcloud: No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers

The lack of a captcah or verificationcodeX it's empty in your phplist configuration allows attackers to use this mail for to send as much spam as they like to victims. I did not reach an email sending limit when I had tested this. PoC images below: Burp suite automated requests:...

HackerOne: Denial of service in report view.

Hello Team! First of all thank you for acknowledging my feature request, I know it will help a lot of users. Description: ========== I just wanted to report a potential vulnerability on the report view functionality. For obvious reasons I'm using my sandboxed team on an alternate account to test...

Securimage Cross-Site Scripting Vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA code. Securimage suffers from a cross-site scripting vulnerability that could allow an attacker to execute arbitrary JavaScript code in a user's browser...

[SECURITY] Fedora 24 Update: python-tgcaptcha2-0.3.1-1.fc24

TGCaptcha2 is a TurboGears widget that provides an easy way to incorporate a captcha as part a form in an attempt to reduce spam or malicious activity. Features include: Relatively pain-free usage and validation inside of a regular widget-based form Flexibility to add or extend image generation...

WordPress Captcha Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Captcha Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...