To bypass Tumblr user registration process in the reCAPTCHA validation-vulnerability warning-the black bar safety net

Hello everyone, this article share it is the author by Tumblr user registration process, found the Tumblr of“human body parts validation”mechanism for reCAPTCHA there is a defect, it can be easily bypassed. This bypasses the formation of the security risk is that a malicious attacker can perform ...

Phishing Scam Cloaks Malware With Fake Google reCAPTCHA

A recently-discovered phishing scam was found peddling malware, using a new technique to mask its malicious landing page: A fake Google reCAPTCHA system. The campaign targeted a Polish bank and its users with emails, said researchers with Sucuri. These emails contained a link to a malicious PHP...

Android banking malware distributed with fake Google reCAPTCHA

By Waqas Sucuri’s cybersecurity researchers have identified a highly sophisticated phishing campaign that is specifically targeting online banking users. The attack, for now, has been directed against a Polish bank in which attackers are exploiting Google reCAPTCHA systems as well as...

unCAPTCHA AI Cracks Google reCAPTCHAs with 90% Accuracy

unCAPTCHA, an artificial intelligence-based automated system designed at the University of Maryland, has been updated to break Google’s latest audio-based reCAPTCHA challenges with an accuracy rate of 90 percent. Google has been working on refining and strengthening reCAPTCHA for years, a Turing...

WordPress Better WordPress reCAPTCHA plugin <= 2.0.3 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Gabriel Avramescu in WordPress Better WordPress reCAPTCHA plugin versions = 2.0.3. Solution WordPress Better WordPress reCAPTCHA plugin was closed on 2018 November 9 and is no longer available for download. Please deactivate and...

Better WordPress reCAPTCHA <= 2.0.3 - Unauthenticated Cross-Site Scripting (XSS)

There is a reflected XSS vulnerability in Better WordPress reCAPTCHA plugin version 2.0.3, and possibly below. The parameter cerror value is reflected in the page when this plugin is enabled. Once plugin disabled, the "cerror" parameter's value is not reflected in the page anymore. This is the HT...

Better WordPress reCAPTCHA <= 2.0.3 - Unauthenticated Cross-Site Scripting (XSS)

There is a reflected XSS vulnerability in Better WordPress reCAPTCHA plugin version 2.0.3, and possibly below. The parameter cerror value is reflected in the page when this plugin is enabled. Once plugin disabled, the "cerror" parameter's value is not reflected in the page anymore. This is the HT...

Google Updates reCAPTCHA: No More Boxes to Check

Google this week has rolled out its latest version of the reCAPTCHA mechanism, which is meant to weed out spam and abuse by robots on websites. It marks a dramatic departure from previous reCAPTCHA efforts by eliminating the need for visitors to take any extra steps in order to log onto a website...

Google Patches reCAPTCHA Bypass

Google has fixed a bypass for its reCAPTCHA authentication mechanism – the Turing test-based methodology for proving that website users aren’t robots, commonly spotted on log-in pages online. The news comes as Google releases a new version of reCAPTCHA in beta. Google has been working on refining...

CF7 Invisible reCaptcha <= 1.3.1 - XSS

The CF7 Invisible reCAPTCHA WordPress plugin was affected by a XSS security vulnerability...

unCAPTCHA algorithm can Crack Google’s AI System reCAPTCHA

By Waqas A new algorithm called unCAPTCHA has been developed by researchers This is a post from HackRead.com Read the original post: unCAPTCHA algorithm can Crack Google’s AI System reCAPTCHA...

Google’s reCaptcha Cracked Again

Google’s reCaptcha service has been cracked by a group of University of Maryland researchers who devised an automated attack that can break the service with 85 percent accuracy. The researchers created a tool called unCaptcha that is able to abuse the audio challenge option of Google’s reCaptcha ...

Low Resource Defeat of reCaptcha’s Audio Challenge: unCaptcha

Across the Internet, hundreds of thousands of sites rely on Google’s reCaptcha system for defense against bots in fact, Devpost uses reCaptcha when creating a new account. After a Google research team demonstrated a near complete defeat of the text reCaptcha in 2012, the reCaptcha system evolved ...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

Google Releases reCAPTCHA API for Android

Google announced today that it has made a new reCAPTCHA API available for Android. The API is part of Google Play Services, Google said, and developers can now add the verification to mobile applications to distinguish between bots and human users. The technology is more than a decade old and...

PT-2017-15230

Name of the Vulnerable Software and Affected Versions Captcha versions prior to 4.3.0 Car Rental versions prior to 1.0.5 Contact Form Multi versions prior to 1.2.1 Contact Form versions prior to 4.0.6 Contact Form to DB versions prior to 1.5.7 Custom Admin Page versions prior to 0.1.2 Custom Fiel...

Nextcloud: IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email

Hi Team, I Was Looking around your website and then I found a subdomain newsletter.nextcloud.com on the main page it shows us 3 Options i choose 1st that was Subscribe to our newsletter , Then I click on this Option and I was Taken to https://newsletter.nextcloud.com/?p=subscribe&id=1 The page...

Weblate: Bypassing captcha in registration on Hosted site

Hello again, I believe the captcha on the user registration form is very simple and can be easily bypassed to automatically register any number of accounts. A program can read the math captcha, solve it and submit the form with the answer and the other required parameters & headers. Note: I read...

Google reCaptcha Bypass Technique Uses Google's Own Tools

A proof of concept bypass of Google’s reCaptcha V2 verification system, posted online Tuesday, uses Google’s own web-based tools to pull off the skirting of the system. The tool dubbed ReBreakCaptcha “lets you easily bypass Google’s reCaptcha v2 anywhere on the web,” according to the author of th...

Phabricator: Enumerating emails through "Forgot Password" form

mongoose mongoose mongoose Hi! I am testing typical local installation of Phabricator. Using the forgot password form it is possible to enumerate users emails because of message There is no account associated with that email address.. So attacker theoretically can figure out registered users emai...