2052 matches found
Zend Framework CAPTCHA Challenge Insufficient Entropy Vulnerability
Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. An insufficient entropy vulnerability exists in ZF. An attacker can exploit this vulnerability to obtain sensitive...
Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word
More info at https://framework.zend.com/security/advisory/ZF2015-09...
Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word
More info at https://framework.zend.com/security/advisory/ZF2015-09...
FreeBSD : codeigniter -- multiple vulnerabilities (698403a7-803d-11e5-ab94-002590263bf5)
The CodeIgniter changelog reports : Fixed an XSS attack vector in Security Library method xssclean. Changed Config Library method baseurl to fallback to $SERVER'SERVERADDR' in order to avoid Host header injections. Changed CAPTCHA Helper to try to use the operating system's PRNG first...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed an XSS attack vector in Security Library method xssclean. Changed Config Library method baseurl to fallback to $SERVER'SERVERADDR' in order to avoid Host header injections. Changed CAPTCHA Helper to try to use the operating system's PRNG first...
Whisper: SMS Invite Form Abuse
whisper.sh fails to protect the invite form from abuse from attackers. If a malicious individual wants to abuse this functionality, they could send repeated/automated requests to the same phone number or range of phone numbers that do no actually belong to himself. This would result in lots of...
ecshop V2.7.3 验证码绕过逻辑漏洞
No description provided by source...
BitHunt: No rate limit or captcha to identify humans
HI, There is no captcha or rate limit to protect from bots against adding request for new products. Check image attached for 20 request sent one after the other with 200 OK status...
plone -- multiple vulnerabilities
Plone.org reports: Versions Affected: All current Plone versions. Versions Not Affected: None. Nature of vulnerability: Allows creation of members by anonymous users on sites that have self-registration enabled, allowing bypass of CAPTCHA and similar protections against scripted attacks. The patc...
WordPress Altos Connect Widget Plugin <= 1.3.0 - Cross Site Scripting (XSS)
This plugin is prone to a cross site scripting vulnerability, because "PHPSELF" is printed without sanitization in a captcha demo page. Solution Update the plugin...
VK.com: Issue in the implementation of captcha and race condition
Reuse of captcha. The researcher was able to find a misconfiguration in the captcha mechanism which allowed him to reuse any captcha and bypass the uniquness of the same . Furthermore the race condition bypassed the no. of retries...
DouPHP 1.2 /admin/login.php 验证码绕过漏洞
No description provided by source...
WordPress Booking Calendar Contact Form Plugin 1.0.2 - Multiple vulnerabilities
Booking Calendar Contact Form plugin is prone to multiple vulnerabilities: 1. Authenticated SQL injection in "get" parameter allows an attacker to escalate editor privileges. 2. Filter bypass & Authenticated SQL injection in "id" parameter via...
ThinkPHP 默认配置导致验证码暴力破解
简要描述： ThinkPHP 默认配置导致验证码暴力破解 详细说明： 最近用Thinkphp时发现，验证码类默认的check函数在检查完验证码是否正确后，并未重置session，导致可被暴力破解。 写这样的代码，再看看Verify类的check函数， public function check$code, $id = '' $key = $this-authcode$this-seKey.$id; // 验证码不能为空 $secode = session$key; ifempty$code || empty$secode return false; // session 过期...
UWA 2.2.1 /lib/ctrlr/Member/MemberCtrlr.class.php SQL注入漏洞
No description provided by source. 由于此漏洞需要验证码 不太好自动化 获取数据库名 membermodelid=1&memberid0=exp&memberid1=111,122,select database,1,1,1,1,1,1,1,1,1,1,1%23 获取表前缀 membermodelid=1&memberid0=exp&memberid1=111,122,select tablename from informationschema.tables where tableschema= 0xxxxxx limit...
Snapchat: Captcha Bypass in Snapchat's Geofilter Submission Process
Hi, Overview: Snapchat provides a form in which users can submit "Geofilters". These are filters which get applied to users snaps when they are in specific geolocations. The form https://www.snapchat.com/geofilters/submit.html allows for the submission of these "Geofilters" as an anonymous user...
WordPress Plugin BestWebSoft Google Captcha Security Bypass Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL servers to set up a personal blog site.BestWebSoft Google Captcha also known as reCAPTCHA is one of the CAPTCHA authentication system plug-ins. A...
WordPress Plugin BestWebSoft Captcha Security Bypass Vulnerability
WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A security vulnerability exists in WordPress...
CVE-2015-0890
The BestWebSoft Google Captcha aka reCAPTCHA plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors...