Cybercriminals Abusing Cloudflare R2 for Hosting Phishing Pages, Experts Warn

Threat actors' use of Cloudflare R2 to host phishing pages has witnessed a 61-fold increase over the past six months. "The majority of the phishing campaigns target Microsoft login credentials, although there are some pages targeting Adobe, Dropbox, and other cloud apps," Netskope security...

Captcha Bypass

github.com/answerdev/answer is vulnerable to Captcha Bypass. The vulnerability exists due to an improper captcha mechanism in captcha.go, which allows an attacker to bypass the captcha technique and create multiple user accounts...

Improper Access Control

github.com/answerdev/answer is vulnerable to Improper Access Control. The vulnerability exists due to the usage of guessable CAPTCHA which allows an attacker to solve a captcha and brute force login attempts...

Phishing campaigns are using AMP URLs to avoid detection

Researchers have found a new phishing tactic which uses Google Accelerated Mobile Pages AMP to make URLs look trustworthy. The tactic is designed to slip past both software and users on the lookout for strange and untrustworthy domain names. AMP is an open-source HTML framework designed to make w...

CVE-2023-3897

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

CVE-2023-3897

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

Information disclosure

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

CVE-2023-3897

CVE-2023-3897 affects 42Gears SureMDM On-premise for Windows, version 6.31 and earlier. The root cause is CAPTCHA bypass that enables attacker to enumerate local usernames via error messages, leading to information disclosure. Impact is limited to credential/identity exposure as described in sour...

CVE-2023-3897 Bypassing CAPTCHA & Enumerating Usernames via Password Reset Page

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

PT-2023-26709 · 42Gears · Suremdm

Name of the Vulnerable Software and Affected Versions: SureMDM On-premise versions 6.31 and below Description: The issue allows for username enumeration through bypassing CAPTCHA in the On-premise SureMDM Solution on Windows deployment. This enables an attacker to enumerate local user information...

42Gears SureMDM 安全漏洞

42gears Mobility Systems 42Gears SureMDM is an asset management platform for mobile devices from 42gears Mobility Systems, USA. The platform is primarily used to monitor and manage enterprise mobile devices. A security vulnerability exists in 42gears Mobility Systems 42Gears SureMDM version 6.31...

Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection Vulnerability

Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0" Exploit Author: Ansh Jain @sudoark Author Contact : email protected Vendor Homepage: https://www.wifi-soft.com/ Software Link:...

Easy Captcha <= 1.0 - Missing Authorization

Description The plugin does not have authorisation in various AJAX actions, which could allow unauthenticated users to call them and perform unauthorised actions...

Easy Captcha <= 1.0 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress CAPTCHA 4WP Plugin <= 7.0.5 is vulnerable to Cross Site Scripting (XSS)

Software CAPTCHA 4WP Type Plugin Vulnerable versions = 7.0.5 Fixed in 7.0.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Melapress PSID 538e2b5c193e Credits Rafie Muhammad Patchstack Required privilege...

CVE-2023-37758

D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi...

CVE-2023-33312

Unauth. Reflected Cross-Site Scripting XSS vulnerability in wppal Easy Captcha plugin = 1.0 versions...

CVE-2023-33312

Unauth. Reflected Cross-Site Scripting XSS vulnerability in wppal Easy Captcha plugin = 1.0 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in wppal Easy Captcha plugin = 1.0 versions...

CVE-2023-33312 WordPress Easy Captcha Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in wppal Easy Captcha plugin = 1.0 versions...