CVE-2024-38873: Improper Access Control

An issue was discovered in the friendlycaptchaofficial aka Integration of Friendly Captcha extension before 0.1.4 for TYPO3. The extension fails to check the requirement of the captcha field in submitted form data, allowing a remote user to bypass the captcha check. This only affects the captcha...

PT-2024-28249 · Typo3 · Friendlycaptcha Official

Name of the Vulnerable Software and Affected Versions: friendlycaptcha official extension versions prior to 0.1.4 for TYPO3 Description: The issue allows a remote user to bypass the captcha check due to the extension's failure to verify the captcha field in submitted form data. This specifically...

Insufficient Entropy

zendframework/zend-captcha is vulnerable to Insufficient Entropy. The vulnerability is due to the use of PHP's arrayrand function, which does not generate sufficient entropy, leading to predictable CAPTCHA words. The attacker can potentially brute force the CAPTCHA words by exploiting the weak...

New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers

Cybersecurity researchers have disclosed details of an ongoing phishing campaign that leverages recruiting- and job-themed lures to deliver a Windows-based backdoor named WARMCOOKIE. "WARMCOOKIE appears to be an initial backdoor tool used to scout out victim networks and deploy additional...

TYPO3-EXT-SA-2024-004: Broken Access Control in "Integration of Friendly Captcha" (friendlycaptcha_official)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2024-004...

Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...

GHSA-848F-MPH5-9PM9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...

Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`

ZendServiceReCaptchaMailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted...

GHSA-4V57-PWVF-X35J Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`

ZendServiceReCaptchaMailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted...

ZendFramework Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...

WordPress Captcha Code plugin Access Control Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...

PT-2024-40370

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select a...

PT-2024-40179

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to the fixed version Description: The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select...

WordPress Captcha/Honeypot for Contact Form plugin Access Control Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...

PT-2024-40024

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue is related to the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to...

CVE-2023-48745

Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9...

CVE-2023-48276

Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1...

CVE-2023-48745 WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability

Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9...

CVE-2023-48745 WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability

Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9...

CVE-2023-48318 WordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerability

Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41...