Veris: Captcha Bypass enable login bruteforce

HI There is captcha bypass, which can lead to login credentials bruteforce attack. Just remove &g-recaptcha-response from request, and the server accepts your request. Please check the screenshots...

Magento CMS has multiple vulnerabilities

Magento is a professional open source PHP e-commerce system of the United States Magento company.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. Magento CE and EE in the existence of HTML injection vulnerabilities , brute-force cracking...

phpwind V9.0 /windid/admin.php 验证码绕过漏洞

No description provided by source...

Mail.ru: Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing

Hi Mail.ru, I was surfing in your website and i was trying to find a Reflected Cross-site Scripting Vulnerability , So i was trying to find a way to inject my payload in a LINK . While Surfing i've found this link : https://pw.mail.ru/validate/index.html?refurl=pw.mail.ru Screenshot :...

ecshop V2.7.3 验证码绕过逻辑漏洞

No description provided by source...

DouPHP 1.2 /admin/login.php 验证码绕过漏洞

No description provided by source...

WordPress Booking Calendar Contact Form Plugin 1.0.2 - Multiple vulnerabilities

Booking Calendar Contact Form plugin is prone to multiple vulnerabilities: 1. Authenticated SQL injection in "get" parameter allows an attacker to escalate editor privileges. 2. Filter bypass & Authenticated SQL injection in "id" parameter via...

WordPress Plugin BestWebSoft Google Captcha Security Bypass Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL servers to set up a personal blog site.BestWebSoft Google Captcha also known as reCAPTCHA is one of the CAPTCHA authentication system plug-ins. A...

CVE-2015-0890

The CVE-2015-0890 issue affects the WordPress plugin “Google Captcha (reCAPTCHA)” by BestWebSoft, with vulnerable versions prior to 1.13 (notably 1.12 and earlier). It enables a CAPTCHA authentication bypass (CWE-254), allowing remote attackers to log in as an administrator via unspecified vector...

Google Captcha (reCAPTCHA) by BestWebSoft vulnerable to CAPTCHA authentication bypass

Overview Google Captcha reCAPTCHA by BestWebSoft is a plugin for WordPress. Google Captcha reCAPTCHA by BestWebSoft contains a CAPTCHA authentication bypass vulnerability CWE-254. Impact If this vulnerability is exploited, an attacker may be able to successfully login to WordPress and access an...

MantisBT 1.2.x < 1.2.19 Multiple Vulnerabilities

According to its version number, the MantisBT application hosted on the remote web server is 1.2.x prior to 1.2.19. It is, therefore, affected by the following vulnerabilities : - An XSS vulnerability exists in 'admin/install.php' that allows remote attackers to inject arbitrary script data via t...

mantisbt: multiple issues

CVE-2014-9571 cross-side scripting Cross-site scripting XSS vulnerability in admin/install.php allows remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter. - CVE-2014-9572 information disclosure It was discovered that mantisbt does not...

ecshop a CAPTCHA bypass logic vulnerability-vulnerability warning-the black bar safety net

Although the code is encrypted, but logically there is a point problem The problem ..\includes\clscaptcha.php By the verification function can be seen directly returned, and no authentication failure processing function checkword$word $recorded = isset$SESSION$this-sessionword ?...

Facebook Linkshim Bypass Vulnerability

This Bypasses the l.php in facebook and granting you full control to send links in your victims without the captcha. It will also be masked by on.fb.me Speaking of Bypass it does not redirect the victim to the warning page. Usage Info You just need some fast moves to create this exploit before it...

Debian DSA-3120-1 : mantis - security update

Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

[SECURITY] [DSA 3120-1] mantis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3120-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 06, 2015 http://www.debian.org/security/faq -...

DSA-3120-1 mantis - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3120-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2224

Plogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote attackers to bypass the CAPTCHA protection mechanism via a series of form submissions...

CVE-2014-2224

CVE-2014-2224 affects Plogger 1.0 RC1 and earlier when the Lucid theme is used. The vulnerability arises because the system does not assign new values for certain codes, enabling remote attackers to bypass the CAPTCHA protection mechanism through a sequence of form submissions. The available sour...