Drupal 6.22 Cross Site Scripting

------------------------- Affected products: ------------------------- Vulnerable are Drupal 6.22 and previous versions. Taking into account that developers didn't fixed these holes, then versions 7.x also must be vulnerable. ---------- Details: ---------- XSS WASC-08: At pages with forms i.e. at...

Make captcha harder, or allow configuration of captcha difficulty, in order to prevent sophisticated spam attacks

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-22700. panel Every day we get a load of automated anonymous comment spam on our confluence pages. It seems that the captcha is t...

Make captcha harder, or allow configuration of captcha difficulty, in order to prevent sophisticated spam attacks

Every day we get a load of automated anonymous comment spam on our confluence pages. It seems that the captcha is too easy. Please can you implement an easily configurable mechanism for making captchas that are harder for spam bots...

Make captcha harder, or allow configuration of captcha difficulty, in order to prevent sophisticated spam attacks

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-22700. panel Every day we get a load of automated anonymous comment spam on our confluence pages. It seems that the captcha is...

Animal husbandry star php web site management system of 0day-vulnerability warning-the black bar safety net

A small program in the holding Station is discovered this app, then across to see the source code. Tragedy just happened! admin/login.php source: ? php sessionstart; include "../include/databaseConfig.inc.php"; $admin = $POST'admin'; $pass = md5$POST'pass'; $codes = $POST'codes'; if$GET'action'...

Hashbot - Forensic web tool to acquire and validate the web pages !

What is hashbot? Hashbot is a forensic web tool to acquire and validate, over time, the status of an individual web page or web document. Feature : Acquire Follow these steps to acquire a web document: 1. Insert the document's URL ie: https://www.evilwebpage.com/image.jpg or...

PHPCaptcha / Securimage 2.0.2 - Authentication Bypass - SOS-11-007

Sense of Security - Security Advisory - SOS-11-007 Release Date. 20-May-2011 Last Update. - Vendor Notification Date. 04-Apr-2011 Product. Securimage / PHPCaptcha Platform. PHP Affected versions. 1.0.4 - 2.0.2 Severity Rating. Medium Impact. Authentication bypass Attack Vector. Remote without...

Easy Contact 0.1.2 WordPress Plugin Cross Site Scripting

Hello list! I want to warn you about Insufficient Anti-automation, Abuse of Functionality and Cross-Site Scripting vulnerabilities in plugin Easy Contact for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Easy Contact 0.1.2 and previous versions...

PHP Captcha Securimage 2.0.2 - Authentication Bypass

PHP Captcha Securimage 2.0.2 - Authentication Bypass Sense of Security - Security Advisory - SOS-11-007 Release Date. 20-May-2011 Last Update. - Vendor Notification Date. 04-Apr-2011 Product. Securimage / PHPCaptcha Platform. PHP Affected versions. 1.0.4 - 2.0.2 Severity Rating. Medium Impact...

websudo does not work with Confluence when it's integrated with Crowd SSO

h5. Steps to reproduce Integrate with Crowd with SSO|http://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management Go to Confluence Admin, it does not prompt to enter password websudo Go to Security Configuration. Note that it will look something like this:...

websudo does not work with Confluence when it's integrated with Crowd SSO

h5. Steps to reproduce Integrate with Crowd with SSO|http://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management Go to Confluence Admin, it does not prompt to enter password websudo Go to Security Configuration. Note that it will look something like this:...

websudo does not work with Confluence when it's integrated with Crowd SSO

h5. Steps to reproduce Integrate with Crowd with SSO|http://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management Go to Confluence Admin, it does not prompt to enter password websudo Go to Security Configuration. Note that it will look something like this:...

XSS, Redirector и IAA уязвимости в MyBB

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, URL Redirector Abuse и Insufficient Anti-automation уязвимостях в MyBB. Для XSS и URL Redirector Abuse используется рабочий аккаунт на уязвимом сайте. О подобных атаках я писал в статье Атаки на незащищённые логин формы...

MC Content Manager 10.1.1 Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions o...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the configuration page in the Recaptcha aka WP-reCAPTCHA plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting...

CVE-2011-0759

Multiple cross-site request forgery CSRF vulnerabilities in the configuration page in the Recaptcha aka WP-reCAPTCHA plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting...

Brute Force и Abuse of Functionality уязвимости в Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Brute Force и Abuse of Functionality уязвимостях в Drupal. Brute Force WASC-11: В форме логина http://site/user/ не реализована надёжная защита от подбора пароля. В самом Drupal капчи нет, а существующий Captcha модуль...

Уязвимости в Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Insufficient Anti-automation уязвимостях в Drupal. Full path disclosure WASC-13: При POST запросе к странице с формой с использованием кириллического символа, выводится сообщение про ошибку, в котором выводится полный путь в...

Drupal Module CAPTCHA - Security Bypass

Drupal Module CAPTCHA - Security Bypass source: https://www.securityfocus.com/bid/46344/info The CAPTCHA module for Drupal is prone to a security-bypass vulnerability that occurs in the CAPTCHA authentication routine. Successful exploits may allow attackers to bypass the CAPTCHA-based...

Drupal Module CAPTCHA - Security Bypass

source: https://www.securityfocus.com/bid/46344/info The CAPTCHA module for Drupal is prone to a security-bypass vulnerability that occurs in the CAPTCHA authentication routine. Successful exploits may allow attackers to bypass the CAPTCHA-based authentication routine, allowing attackers to perfo...