AWS CAPTCHA Bypass

The process of AWS login has a feature: if you use "fresh" browserno cookie, no cache, etc to sign in, put correct email and correct password there, CAPTCHA is required"To better protect your account, please re-enter your password and then enter the characters as they are shown in the image below...

[SECURITY] Fedora 23 Update: python-tgcaptcha2-0.3.1-1.fc23

TGCaptcha2 is a TurboGears widget that provides an easy way to incorporate a captcha as part a form in an attempt to reduce spam or malicious activity. Features include: Relatively pain-free usage and validation inside of a regular widget-based form Flexibility to add or extend image generation...

[SECURITY] Fedora 22 Update: python-tgcaptcha2-0.3.1-1.fc22

TGCaptcha2 is a TurboGears widget that provides an easy way to incorporate a captcha as part a form in an attempt to reduce spam or malicious activity. Features include: Relatively pain-free usage and validation inside of a regular widget-based form Flexibility to add or extend image generation...

Wordpress SI CAPTCHA AntiSpam 插件-test/index.php-跨站脚本漏洞

No description provided by source...

Gratipay: An adversary can harvest email address for spamming.

The website is displaying email address. These email address can be harvested by automated programs called bots and then used as a target for spamming. 1. Use any Email extractor tool or Add on. Here I have used Chrome Email Extractor Add on offered by Mr. Alien. 2. In Browser open...

New Relic: Old CAPTCHA offers no protection

To rate-limit users, you use an old CAPTCHA method that has been broken for quite a while due to developments in OCR. There are many services that are available to quickly solve these and so it offers no protection. For example, here is one site that offers easy CAPTCHA breaking:...

Securimage Cross-Scripting Vulnerability

Securimage is an open source PHP CAPTCHA script for generating CAPTCHA images and CAPTCHA code . Securimage suffers from a cross-scripting vulnerability. An attacker exploits the vulnerability to inject arbitrary JavaScript code via a specially crafted URL, resulting in a cross-site scripting XSS...

Securimage 3.6.2 Cross Site Scripting

Advisory: Cross-site Scripting in Securimage 3.6.2 RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the Securimage CAPTCHA software, which allows attackers to inject arbitrary JavaScript code via a crafted URL. Details ======= Product: Securimage Affected Versions: = 3.2R...

Veris: Captcha Bypass enable login bruteforce

HI There is captcha bypass, which can lead to login credentials bruteforce attack. Just remove &g-recaptcha-response from request, and the server accepts your request. Please check the screenshots...

New Relic: No Rate Limitation on Promo Code

Hello, there is no rate limitation on entering "promo code" while upgrading the subscription. an attacker can bruteforce the promo code and could get a lot of benefits with that. https://rpm.newrelic.com/accounts/XXXXXXX/products i have tested this bug by attempting 500+ invalid promo code. and g...

WordPress Best Web Soft Captcha Plugin 4.1.5 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, such as XSS and CSRF. Because of that, an attacker can send admin a URL crafted for the example, http://wwww.victim.com/wp-admin/admin.php?page=captcha.php&action=whitelist&s=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E or send a form, that will...

WordPress Best Web Soft Captcha 4.1.5 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: BWS Captcha Multiple Vulnerabilities Discovery Date:12.03.2015 Public Disclosure Date:03.10.2016 Exploit Author: Colette Chamberland Contact: email protected Vendor Homepage: http://bestwebsoft.com/ Software Link:...

Magento CMS has multiple vulnerabilities

Magento is a professional open source PHP e-commerce system of the United States Magento company.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. Magento CE and EE in the existence of HTML injection vulnerabilities , brute-force cracking...

Veris: Password(s) can be found via login process.

Hello security team, It is possible to find passwords of other users by enumerate the login process. The scenario is quiet simple: 1 Go to https://sandbox.veris.in/portal/login/ 2 Fill in 'Email ID' and 'Password' and click 'Log In' 3 Capture the request via burp suite and send it to intruder. 4...

forum.sohagame.vn XSS vulnerability

Vulnerable URL: http://forum.sohagame.vn/captcha/captcha.php?callback=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:10 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

phpwind V9.0 /windid/admin.php 验证码绕过漏洞

No description provided by source...

Mail.ru: Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing

Hi Mail.ru, I was surfing in your website and i was trying to find a Reflected Cross-site Scripting Vulnerability , So i was trying to find a way to inject my payload in a LINK . While Surfing i've found this link : https://pw.mail.ru/validate/index.html?refurl=pw.mail.ru Screenshot :...

WordPress Captcha 4.0.2 Cross Site Scripting

Plugin Name : Captcha Effected Version : 4.0.2 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept :...

Ovidentia Captcha (Version 0.7) Module Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Title: Ovidentia Module Captcha Version 0.7 Remote File Inclusion Author: GoLdM Download: http://www.ovidentia.org/modules/babArticle731 PoC : \captcha-0-7\programs\captcha.class.php ------------------------------------------------------...

WordPress Google Captcha 1.05 Cross Site Scripting

Plugin Name : Google Captcha reCAPTCHA Effected Version : 1.05 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the...