CF7 Invisible reCaptcha <= 1.3.1 - XSS

The CF7 Invisible reCAPTCHA WordPress plugin was affected by a XSS security vulnerability...

uncaptcha - Defeating Google's audio reCaptcha with 85% accuracy

Defeating Google's audio reCaptcha system with 85% accuracy. Inspiration Across the Internet, hundreds of thousands of sites rely on Google's reCaptcha system for defense against bots in fact, Devpost uses reCaptcha when creating a new account. After a Google research team demonstrated a near...

unCAPTCHA algorithm can Crack Google’s AI System reCAPTCHA

By Waqas A new algorithm called unCAPTCHA has been developed by researchers This is a post from HackRead.com Read the original post: unCAPTCHA algorithm can Crack Google’s AI System reCAPTCHA...

Google’s reCaptcha Cracked Again

Google’s reCaptcha service has been cracked by a group of University of Maryland researchers who devised an automated attack that can break the service with 85 percent accuracy. The researchers created a tool called unCaptcha that is able to abuse the audio challenge option of Google’s reCaptcha ...

Low Resource Defeat of reCaptcha’s Audio Challenge: unCaptcha

Across the Internet, hundreds of thousands of sites rely on Google’s reCaptcha system for defense against bots in fact, Devpost uses reCaptcha when creating a new account. After a Google research team demonstrated a near complete defeat of the text reCaptcha in 2012, the reCaptcha system evolved ...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

Google Releases reCAPTCHA API for Android

Google announced today that it has made a new reCAPTCHA API available for Android. The API is part of Google Play Services, Google said, and developers can now add the verification to mobile applications to distinguish between bots and human users. The technology is more than a decade old and...

Nextcloud: IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email

Hi Team, I Was Looking around your website and then I found a subdomain newsletter.nextcloud.com on the main page it shows us 3 Options i choose 1st that was Subscribe to our newsletter , Then I click on this Option and I was Taken to https://newsletter.nextcloud.com/?p=subscribe&id=1 The page...

Weblate: Bypassing captcha in registration on Hosted site

Hello again, I believe the captcha on the user registration form is very simple and can be easily bypassed to automatically register any number of accounts. A program can read the math captcha, solve it and submit the form with the answer and the other required parameters & headers. Note: I read...

Google reCaptcha Bypass Technique Uses Google's Own Tools

A proof of concept bypass of Google’s reCaptcha V2 verification system, posted online Tuesday, uses Google’s own web-based tools to pull off the skirting of the system. The tool dubbed ReBreakCaptcha “lets you easily bypass Google’s reCaptcha v2 anywhere on the web,” according to the author of th...

Phabricator: Enumerating emails through "Forgot Password" form

mongoose mongoose mongoose Hi! I am testing typical local installation of Phabricator. Using the forgot password form it is possible to enumerate users emails because of message There is no account associated with that email address.. So attacker theoretically can figure out registered users emai...

bitaccess: Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error.

Due to a bug on session management, Rate limit was not properly applied to some functionalities on the website, which let a bad actor to send unlimited password reset emails by bypassing the Recaptcha rate limit. This was not a security issue, fixed to prevent spamming users...

New Relic: Old CAPTCHA offers no protection

To rate-limit users, you use an old CAPTCHA method that has been broken for quite a while due to developments in OCR. There are many services that are available to quickly solve these and so it offers no protection. For example, here is one site that offers easy CAPTCHA breaking:...

phpMyAdmin 4.3.x < 4.3.13.2 / 4.4.x < 4.4.14.1 reCaptcha Bypass (PMASA-2015-4)

Binary data 9105.prm...

phpMyAdmin Security Bypass Vulnerability (Nov 2015) - Linux

phpMyAdmin is prone to reCaptcha bypass vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyadmin:phpmyadmin";...

phpMyAdmin Security Bypass Vulnerability (Nov 2015) - Windows

phpMyAdmin is prone to reCaptcha bypass vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyadmin:phpmyadmin";...

[SECURITY] [DSA 3382-1] phpmyadmin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3382-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst October 28, 2015 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3382-1 (phpmyadmin - security update)

Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. CVE-2014-8958 Wheezy only Multiple cross-site scripting XSS vulnerabilities. CVE-2014-9218 Wheezy only Denial of service resource consumption via a long password. CVE-2015-2206 Risk of BREACH attack due to...

Debian: Security Advisory (DSA-3382-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : phpMyAdmin (openSUSE-2015-629)

phpMyAdmin was updated to the latest supported upstream release 4.4.14. Besides all upstream bug fixes and improvements, it fixes the following vulnerability : - CVE-2015-6830: reCaptcha bypass boo945420 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...