2088 matches found
CAPTCHA Detection
Detects any known CAPTCHA products being used on a page. No source data...
Fraudsters Using GiftGhostBot Botnet to Steal Gift Card Balances
Gift cards have once again caused quite a headache for retailers, as cyber criminals are using a botnet to break into and steal cash from money-loaded gift cards provided by major retailers around the globe. Dubbed GiftGhostBot, the new botnet specialized in gift card fraud is an advanced...
Cross-site Scripting (XSS)
jquery-validation is vulnerable to cross-site scripting XSS attacks. The vulnerability is due to a flaw in demo/captcha. All the websites which use this jquery plugin to perform easy form validation functionality are affected...
Rockstar Games: Bypass CAPTCHA protection
In this report, the researcher found that it was possible to bypass our CAPTCHA check by injecting a random value into the X-Forwarded-For header in the sign in POST request. At the time the researcher submitted this report, we only enforced CAPTCHA checks on sign-in requests that had failed...
Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com
Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...
Automattic: Captcha bypass for the most important function - At en.instagram-brand.com
Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...
LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)
Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumption from the server by abusing the captcha servlet Description: By sending a specially crafted request and changing the height/width parameters in the captcha form it is possib...
Starbucks: Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud
Summary: The pages https://www.starbucks.com/account/card/addcard and https://www.starbucks.com/account/card/Balance do not properly enforce security controls to limit POST requests. This bug allows attackers to successfully hijack a loaded Starbucks card and transfer all the funds into their own...
schoolbag.ru XSS vulnerability
Vulnerable URL: http://schoolbag.ru/my/s3/captcha/get.php?callback=prompt/OPENBUGBOUNTY/...
pmcomp.ru XSS vulnerability
Vulnerable URL: http://pmcomp.ru/my/s3/captcha/get.php?callback=prompt/OPENBUGBOUNTY/...
elstile.ru XSS vulnerability
Vulnerable URL: http://www.elstile.ru/my/s3/captcha/get.php?callback=prompt/OPENBUGBOUNTY/...
D-Link DIR-300NRUB5 Firmware 1.2.94 Cross Site Request Forgery
Hello list! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DIR-300. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DIR-300NRUB5, Firmware 1.2.94. All previous versions also must be...
CVE-2016-8600
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...
CVE-2016-8600
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...
Code injection
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...
CVE-2016-8600
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...
CVE-2016-8600
dotCMS CAPTCHA bypass vulnerability (CVE-2016-8600) affects dotCMS 3.2.1, where the CAPTCHA code can be reused within the same session: after loading a CAPTCHA, an attacker can submit the form with that correct code for subsequent checks. Root cause: last loaded CAPTCH A code persists in the sess...
TGCaptcha2 Replay Attack Vulnerability
TGCaptcha2 is a suite of tools that provide a reduction in spam or malicious activity by combining CAPTCHAs as a single form. A replay attack vulnerability exists in TGCaptcha2 version 0.3.0. An attacker can exploit the vulnerability to use the same CAPTCHA an unlimited number of times...
Cross-site scripting vulnerability in wordpress plugin contact-form-with-captcha
Contact Form With Captcha is a Wordpress plugin with CAPTCHA plugin Contact Form allows users to access Wordpress blogs using Google CAPTCHA form, it requires PHP 5 or higher. Wordpress plugin contact-form-with-captcha suffers from an xss vulnerability due to improper filtering of user input, whi...