2083 matches found
CVE-2019-17525
CVE-2019-17525 concerns the login page of the D-Link DIR-615 T1 with firmware 20.10, where an issue allows remote attackers to bypass CAPTCHA protection and perform brute-force login attempts. The connected sources confirm a CAPTCHA bypass vulnerability on DIR-615 T1 20.10, enabling credential br...
CVE-2019-17525
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...
Cloudflare Axes Google reCAPTCHA Due to Privacy, Price
Cloudflare is nixing Google’s reCAPTCHA tool and replacing it with what the network services company’s CEO calls “a better CAPTCHA” service, hCaptcha. Google’s reCAPTCHA is a type of CAPTCHA an acronym for “Completely Automated Public Turing Test to Tell Computers and Humans Apart” that uses...
Staging.every.org: No Rate Limit On Reset Password
Summary: A rate limiting algorithm is used to check if the user session or IP address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP servers can respond with status code 429: Too Many Requests. wikipedia I...
Easy!Appointments Authorization Issues Vulnerability
Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in Easy!Appointments version 1.3.0. An attacker can exploit this vulnerability to bypass CAPTCHA protection...
CVE-2018-13060
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue...
CVE-2018-13060
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue...
Code injection
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue...
CVE-2018-13060
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue...
CVE-2018-13060
CVE-2018-13060 affects Easy!Appointments 1.3.0. Multiple connected sources document a vulnerability where CAPTCHA protection can be bypassed, enabling an attacker to bypass CAPTCHA and potentially abuse the login/appointment flow. Root cause details in the sources indicate a guessable CAPTCHA iss...
ambition-edc (>=0.3.68 <=0.3.72), caluma (>=5.2.1 <=5.3.1) +28 more potentially affected by CVE-2020-9402 via django (>=2.2.0 <=2.2.10)
django PYPI version =2.2.0, =0.3.68, =5.2.1, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.26 - django-smorest =0.1.3 - djangorestframework-simplejwt-captcha =1.1.4 - djpub =0.0.1 and more Source cves: CVE-2020-9402 Source advisory: OSV:PYSEC-2020-36...
Bumble: On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easilty
Hello there how are you doing ? Go to sign up page and enter a new phone number and you will be redirected to https://bumble.com/registration/confirm-phone . You will receive a easy breakable 4 digit OTP Code . I waited for about 4 hours and the OTP did not expired , This shows that the OTP can b...
Nord Security: No Rate Limit On Forgot Password Page Of affiliates.nordvpn.com
Introduction:- A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP-Servers can respond with status code...
The vulnerability in the web interface of software for Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center allows a perpetrator to disclose protected information.
The vulnerability of the software web interfaces for Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center is related to the absence of CAPTCHA protection. Exploiting this vulnerability can allow a malicious actor to disclose protected...
CVE-2019-19825
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...
CVE-2019-19825
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...
Design/Logic Flaw
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...
CVE-2019-19825
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...
CVE-2019-19825
Summary of CVE-2019-19825 (Realtek SDK / TOTOLINK routers) Authenticated CAPTCHA bypass vulnerability affecting Realtek SDK-based routers (TOTOLINK and others) via a POST to boafrm/formLogin with payload {"topicurl":"setting/getSanvas"}. The CAPTCHA text can be retrieved without authentication, e...