CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

Session fixation

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 is affected by CVE-2017-7673 due to weak cryptographic storage and missing brute-force protection in authentication-related forms, with registration and password-reset flows lacking captcha. Connected docs confirm the vulnerability details but do not provide a remediatio...

Mail.ru: BruteForce Any [My.com] Account Credentials.

CAPTCHA entered on account.my.com was not actually checked. account.my.com has no relation to My.Com's MyMail and is not currently covered by regular Mail.Ru bug bounty program...

Nanjing Palm Public Transportation APK has CAPTCHA Leakage Vulnerability

Nanjing Palm Bus is jointly created by Nanjing Public Transportation Group Co., Ltd. and Jiangsu Provincial Radio and Television Station Group. It is the only palmtop intelligent integrated service platform in Nanjing that collects real-time bus location inquiry, local news, live mobile TV and...

Password Breaches Fueling Booming Credential Stuffing Business

The market for credential stuffing software and services is thriving thanks in large part to an epidemic of breaches of usernames and passwords. Digital Shadows said today in a new report that credential leaks, such as this past month’s Anti Public Combo List and others, have buoyed the market fo...

Allen Disk Security Bypass Vulnerability

Allen Disk is a free, open source cloud-based hard disk product that features encrypted file storage, online preview, file sharing and more. A security bypass vulnerability exists in the reg.php file in Allen Disk version 1.6. An attacker can exploit this vulnerability to bypass CAPTCHA with the...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

Design/Logic Flaw

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

Design/Logic Flaw

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9091

The CVE-2017-9091 entry concerns Allen Disk 1.6: /admin/loginc.php does not verify isset($_SESSION['captcha']['code']) before processing, enabling CAPTCHA bypass by clearing $_POST['captcha']. The Red Hat and NVD records confirm the same issue; no public exploit details or patches are described i...

CVE-2017-9091

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...

CVE-2017-9090

reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...

CVE-2017-9090

The CVE-2017-9090 issue affects Allen Disk 1.6’s reg.php, where there is no proper check of isset($_SESSION['captcha']['code']), enabling bypass of CAPTCHA via an empty $_POST['captcha']. The vulnerability is documented across multiple feeds (NVD entry with CVSSv2/3 scores indicating low–high imp...

Weblate: Captcha bypass at registration

Affected URL: https://demo.weblate.org/accounts/register/ Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above UR...