Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072

The Clientside Validation module enables you to have clientside Javascript validation on your forms. The module does not sufficiently validate parameters of a POST request made when validating a CAPTCHA. For the 1.x version of this module, this vulnerability is mitigated by the fact that the...

CAPTCHA - Moderately Critical - Denial of Service - SA-CONTRIB-2017-073

This module enables you to use various techniques to block automated scripts / robots from submitting content to a site, e.g. to block spam comments. The module doesn't properly store the session ID of visitors who are given a session which could lead to a Denial of Service attack. This...

Tor: [rt.torproject.org] No Rate Limitting on Login Form

Vulnerability description not provided...

Shenzhen Yuanzheng Technology golo Android APP has arbitrary account login vulnerability

golo APP is a social networking application that uses instant messaging as a communication platform to connect automotive repair technicians with car owners. A vulnerability exists in Shenzhen Yuanzheng Technology's golo Android APP that allows an attacker to log in to any account. An attacker ca...

Shenzhen Yuanzheng Technology goloZ Android APP has arbitrary account password reset vulnerability

goloZ APP is a product developed by Shenzhen Yuanzheng Technology to provide auto repair service. There is an arbitrary account password reset vulnerability in Shenzhen Yuanzheng Technology's goloZ Android APP. An attacker can reset any registered user's password by CAPTCHA blasting...

Charging Pile Android App has Arbitrary Account Password Reset Vulnerability

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. Charging Pile Android APP has an arbitrary account password reset vulnerability. Allowing an attacker to reset a user's password by captcha...

Shenzhen Yuanzheng Technology golo merchant Android APP has arbitrary account password reset vulnerability

golo merchant is an app developed by Shenzhen Yuanzheng Technology to provide auto repair services. There is an arbitrary account password reset vulnerability in the golo merchant android app of Shenzhen Yuanzheng Technology. An attacker can reset any registered user's password by means of CAPTCH...

Wheeling Self-Driving Android App is vulnerable to arbitrary account password resets

Wheel Self-Driving APP is a self-driving comprehensive service center software. The Rolling Self-Driving Android APP is vulnerable to arbitrary account password reset vulnerability. It allows an attacker to reset any registered account password by means of CAPTCHA blasting...

Denial of Service Vulnerability in Electricity Free Android App

Electricity Worry-free APP is a cross electrical equipment professional service platform. A denial of service vulnerability exists in the Electricity Worry Free Android APP. It allows an attacker to traverse a cell phone number and send unlimited CAPTCHAs to the cell phone, consuming server...

Willow Police App Has Arbitrary Account Login Vulnerability

Liuzhou Police APP is a police information application platform launched by Liuzhou Municipal Public Security Bureau. Liuzhou Police APP has an arbitrary account login vulnerability. By means of CAPTCHA blasting, an attacker can log in to any account through a cell phone number...

CAPTCHA Bypass Vulnerability in FAW-Volkswagen After-Sales Service App Android Version

FAW-VW After-sales Service APP is a software that provides professional after-sales service. Through this software, you can call roadside assistance with one click at anytime and anywhere. The software also provides personal automobile information, online reservation and automobile repair progres...

CAPTCHA Bypass Vulnerability in Genuine Technology APP Android Version

Chuangyuan Technology APP is a collection of intelligent property, intelligent parking, intelligent home, intelligent building control, green energy management and other intelligent park solutions, aiming to create intelligent office experience and life experience for all kinds of users in the pa...

Weblate: No rate limit or captcha to identify humans

Affected URL: https://hosted.weblate.org/hosting/ Issue: There is no captcha or rate limit to protect from bots against adding request for new project hosting. Which makes it easy for an attacker to perform spamming. Shall you need any more info notify me,...

CAPTCHA Bypass

in2code/powermail is vulnerable CAPTCHA bypass. This is possible because the == operator is used to compare if the if code is set and equal to session value...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

Design/Logic Flaw

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

CVE-2017-11717

MetInfo CMS up to version 5.3.17 contains a captcha handling flaw: the same CAPTCHA response can be accepted for 120 seconds, enabling remote attackers to bypass challenges by tampering with the client–server data stream (login/findpass page). Affected product is MetInfo; root cause is reuse of a...

CVE-2017-11717

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...

MetInfo has a logic flaw

MetInfo is a Content Management System CMS developed using PHP and Mysql. A logic vulnerability exists in MetInfo 5.3.17 and earlier versions. A remote attacker can exploit this vulnerability by changing the data flow between client servers to bypass captcha...