2052 matches found
HackerOne: Flooding mailbox of user
There seems to be no prevention from sending multiple password reset links to a selected e-mail. As a result mailbox of the user can be flooded with these mails. I would recommend to add CAPTCHA in forgot password functionality...
Vulnerability Allows Anyone to DDoS Websites Using Facebook Servers
Reading a 'Note' created by anyone on the Facebook could trick you automatically to do malicious attacks against others unknowingly. A Security researcher Chaman Thapa, also known as chr13 claims that the flaw resides in 'Notes' section of the most popular social networking site - Facebook, that...
[SECURITY] Fedora 19 Update: php-ZendFramework2-2.2.6-1.fc19
Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...
IRCCloud: CSRF - Creating accounts
Hi there, I've discovered the following CSRF issue: There's no CSRF / Bot protection on the registration form. Details An attacker could automate the registration process to flood your database with invalid/useless accounts. He could also source the process out to his victims CSRF. Steps to...
Captcha Bypass in extension "powermail" (powermail)
It has been discovered that the extension "powermail" powermail is susceptible to Captcha Bypass Release Date: April 10, 2014 Bulletin update: September 18, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions:...
ReddAPI: No Captcha or rate limit on Login Page
Hello ReddApi Security Team, Vulnerability Detail's:- Login page can be brute forced due to lack of captcha or backoff Impact:- An attacker can bruteforce for a particular username and can get a possibly a account takeover. POC:- I have made a proof of concept video of the same:-...
MGASA-2014-0167 Updated perl-Authen-Captcha package uses randomly generated filenames
An issue in previous versions of perl-Authen-Captcha is that the generated public string file name of the picture for the captcha is merely a checksum of the secret string. It is trivial to break such short strings even using google instead of a rainbow table. This new version of...
Updated perl-Authen-Captcha package uses randomly generated filenames
An issue in previous versions of perl-Authen-Captcha is that the generated public string file name of the picture for the captcha is merely a checksum of the secret string. It is trivial to break such short strings even using google instead of a rainbow table. This new version of...
ReddAPI: Login page password-guessing attack
Hello team of Reddapi! Here to report a vulnerability on your site. Affected site: www.reddapi.com Vulnerability: Login page password-guessing attack Severity:Low. Vulnerability description: A brute-force attack is an attempt to discover a password by systematically trying every possible...
Fedora Update for perl-Authen-Captcha FEDORA-2014-4455
Check for the Version of perl-Authen-Captcha OpenVAS Vulnerability Test Fedora Update for perl-Authen-Captcha FEDORA-2014-4455 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/o...
Fedora Update for perl-Authen-Captcha FEDORA-2014-4454
Check for the Version of perl-Authen-Captcha OpenVAS Vulnerability Test Fedora Update for perl-Authen-Captcha FEDORA-2014-4454 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/o...
Fedora Update for perl-Authen-Captcha FEDORA-2014-4455
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora Update for perl-Authen-Captcha FEDORA-2014-4454
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
InVision: captcha missing
login and go to projects section, choose any project. 2. Click on share, click on 'Password Protect' option and enter any password. 3. Now open new browser and load the link shared. It asks for password. Try 40-50 attempts of wrong passwords, the application doesn't asks for captcha...
Fedora 19 : perl-Authen-Captcha-1.024-1.fc19 (2014-4454)
An issue in previous versions of perl-Authen-Captcha is that the generated public string file name of the picture for the captcha is merely a checksum of the secret string. It is trivial to break such short strings even using google instead of a rainbow table. Version 1.024 of the module fixes...
Fedora 20 : perl-Authen-Captcha-1.024-1.fc20 (2014-4455)
An issue in previous versions of perl-Authen-Captcha is that the generated public string file name of the picture for the captcha is merely a checksum of the secret string. It is trivial to break such short strings even using google instead of a rainbow table. Version 1.024 of the module fixes...
[SECURITY] Fedora 19 Update: perl-Authen-Captcha-1.024-1.fc19
Authen::Captcha provides an object oriented interface to captcha file creations. Captcha stands for Completely Automated Public Turning test to tell Computers and Humans Apart...
[SECURITY] Fedora 20 Update: perl-Authen-Captcha-1.024-1.fc20
Authen::Captcha provides an object oriented interface to captcha file creations. Captcha stands for Completely Automated Public Turning test to tell Computers and Humans Apart...
Web message boards of the Big Three dangerous vulnerability-a vulnerability warning-the black bar safety net
Message boards as a web page with the viewer interactive media and popular,in a variety of large and small site almost always has its shadow,so the message Board is now the site of a key protagonist,so its safe not not seriously considered,now listed in the guestbook when making the three big...
