Liberapay: No Data Validation, No Captcha, No Filters...

POST /for/new HTTP/1.1 Host: liberapay.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:52.0 Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...

Kangaroo Life App has a Bursting Vulnerability

Kangaroo Life App is a mobile lending software. Kangaroo Life APP has a blasting vulnerability. Attackers can log in to any account by grabbing packets and blasting CAPTCHA...

Logic Design Vulnerability in Catfish CMS/Blog System Logins

Catfish catfish CMS is open source PHP content management system. A logical design vulnerability exists in the Catfish CMS/Blog system login. Allow attackers to exploit the vulnerability to bypass the CAPTCHA authentication and carry out unlimited blasting attacks on the system...

New Relic: Captcha Bypass on SignUp Form

The g-recaptcha-response parameter was not validated on the server side when submitting a form to the /signups endpoint. Any or no value could be provided for this parameter...

XiaoCMS admin\controller\login.php page has a logical design vulnerability

XiaoCms Enterprise Builder is a small, flexible, simple and easy-to-use lightweight cms based on PHP+Mysql architecture. XiaoCMS admin\controller\login.php page has a logical design vulnerability. The vulnerability is due to the CAPTCHA judgment and restriction of the login function, the attacker...

Lend a Little Loan App Has Arbitrary User Registration Vulnerability

Lend a little with a loan app is an emergency loan platform. There is an arbitrary user registration vulnerability in Lend a Little with Loan APP. Attackers can register any account by grabbing packets and blasting CAPTCHA...

Advanced Dork Searching Utility: Zeus-Scanner

Zeus is an advanced reconnaissance utility designed to make web application reconnaissance simple. Zeus comes complete with a powerful built-in URL parsing engine, multiple search engine compatibility, the ability to extract URLs from both ban and webcache URLs, the ability to run multiple...

Touhou Shared Bike Android App Has Logic Design Flaws

TouTou Shared Bike Android APP is a shared bike travel software for cities. A logical design vulnerability exists in TouTou Shared Bicycle Android APP. An attacker can log in to any user account and perform unauthorized operations by grabbing packets and blasting CAPTCHA...

Vivo Bike Share Android App Has Logic Design Flaws

Vivo Bike Share Android APP is a bike sharing rental software. There is a logic design vulnerability in Vivi Bike Sharing Android APP. Attackers can register any account by grabbing packets and blasting CAPTCHA...

Forbidden Horse Travel App has a logic design flaw

The Forbidden Horse Mobility App is a cell phone application for sharing motorcycles. There is a logic design loophole in Foramar Mobility APP, which allows attackers to arbitrarily register users or steal other users' account information for picking up a bike by grabbing packets and bursting...

Aier Eye Group's Eye Neighborhood Doctor's Edition App for Android Has Logic Design Flaws

Eye Neighborhood Doctor Edition App is an application designed and developed for ophthalmologists and ophthalmology practitioners. The Android version of Eye Neighborhood Doctor Edition APP of Aier Ophthalmology Group has a logic design vulnerability, which allows attackers to successfully regist...

MantisBT Security Bypass Vulnerability (CNVD-2017-33719)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in versions of MantisBT prior to 1.2.19. An attacker can exploit the vulnerability t...

CVE-2014-9624

CAPTCHA bypass vulnerability in MantisBT before 1.2.19...

CVE-2014-9624

CAPTCHA bypass vulnerability in MantisBT before 1.2.19...

Design/Logic Flaw

CAPTCHA bypass vulnerability in MantisBT before 1.2.19...

CVE-2014-9624

CVE-2014-9624 affects MantisBT versions earlier than 1.2.19, where a CAPTCHA bypass vulnerability exists. Multiple sources (CNVD-2017-33719, UB Ubuntu CVE page, NVD entry) describe that an attacker can bypass CAPTCHA testing by obtaining unlimited CAPTCHA samples with perturbations for the same c...

CAPTCHA Bypass Vulnerability in FAW-Volkswagen After-Sales Service App Android Version

FAW-VW After-sales Service APP is a software that provides professional after-sales service. Through this software, you can call roadside assistance with one click at anytime and anywhere. The software also provides personal automobile information, online reservation and automobile repair progres...

CAPTCHA Bypass Vulnerability in Genuine Technology APP Android Version

Chuangyuan Technology APP is a collection of intelligent property, intelligent parking, intelligent home, intelligent building control, green energy management and other intelligent park solutions, aiming to create intelligent office experience and life experience for all kinds of users in the pa...

CAPTCHA Bypass

in2code/powermail is vulnerable CAPTCHA bypass. This is possible because the == operator is used to compare if the if code is set and equal to session value...

CVE-2017-11717

MetInfo CMS up to version 5.3.17 contains a captcha handling flaw: the same CAPTCHA response can be accepted for 120 seconds, enabling remote attackers to bypass challenges by tampering with the client–server data stream (login/findpass page). Affected product is MetInfo; root cause is reuse of a...