D-Link DIR-605L Captcha Handling Buffer Overflow Vulnerability

This Metasploit module exploits an anonymous remote code execution on D-Link DIR-605L routers. The vulnerability exists while handling user supplied captcha information, and is due to the insecure usage of sprintf on the getAuthCode function. This Metasploit module has been tested successfully on...

D-Link DIR-605L Captcha Handling Buffer Overflow

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 /Boa/ include Msf::Exploit::Remote::HttpClient def initializeinfo = superupdateinfoinfo, 'Name' = 'D-Link DIR-605L Captcha Handling...

Dell Quest One Password Manager CAPTCHA Bypass

-= Disclosure =- Filing Date: Today Issue Tracking Numbah: 20747 Discoverorer: Johnny Bravo -= Background =- Quest made a password management web thing. Dell bought Quest. Dell offers Quest Onetm Password Manager for $5/user. http://software.dell.com/products/password-manager/. Oddly, this is not...

AVTECH DVR Multiple Vulnerabilities

This host is running AVTECH DVR and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbavtechdvrmultiplevuln.nasl 6074 2017-05-05 09:03:14Z teissa $ AVTECH DVR Multiple Vulnerabilities Authors: Antu Sanadi Copyright: Copyright c 2013 Greenbone Networks GmbH,...

AVTECH DVR Multiple Vulnerabilities

AVTECH DVR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ecshop to bypass the CAPTCHA windfall hack-vulnerability warning-the black bar safety net

Brief description: Should popular version of this problem exists Detailed description: ! ! If the verification code does not match, and did not destroy the current CAPTCHA So can one request the CAPTCHA image, as long as no refresh verification code you can always use Vulnerability proof: 1. To...

AVTECH DVR Buffer Overflow / CAPTCHA Bypass

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ AVTECH DVR multiple vulnerabilities 1. Advisory Information Title: AVTECH DVR multiple vulnerabilities Advisory ID: CORE-2013-0726 Advisory URL: http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities Date...

Short Password Reset code vulnerability allows hackers to brute-force many websites

Yesterday we received a vulnerability report in web applications from some unknown Indian Hacker, who explained that how Hackers are hijacking Mobile recharge and Free SMS service related websites. He detailed the loophole in password reset process, that could allow attackers to brute force many...

TYPO3 Maag Form Captcha开放重定向漏洞

BUGTRAQ ID: 60298 CVECAN ID: CVE-2013-4680 Typo3是开源内容管理系统（CMS）和内容管理框架（CMF）。 TYPO3的Maag Form Captcha 2.0.0及更早版本存在开放重定向漏洞，攻击者利用此漏洞可将用户重定向到任意网站并执行钓鱼攻击。 0 TYPO3 Maag Form Captcha = 2.0.0 厂商补丁： TYPO3 ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://typo3.org/extensions/repository/...

CVE-2013-4680

Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Open redirect

Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4680

Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4680

The CVE-2013-4680 entry concerns TYPO3’s Maag Form Captcha extension (versions 2.0.0 and earlier). The vulnerability is an open redirect in the extension, allowing attackers to redirect users to arbitrary websites and facilitate phishing via unspecified vectors. The connected sources note that TY...

find_captchas

This plugin finds any CAPTCHA images that appear on a HTML document. The crawl is performed by requesting the document two times, and comparing the image hashes, if they differ, then they may be a CAPTCHA. Plugin type Crawl Options This plugin doesnt have any user configured options. Source For...

ecshop绕过验证码暴利破解3

简要描述： 不用给分了，都不好意思要了（确实不是故意的，刚发现） rt 第一次的漏洞利用程序有个bug 但是因为有这个bug 导致了成功利用了发现的第三处漏洞 第二次漏洞也是并没有用到第二次所提到的漏洞，其实是本次的 好吧，有些绕口 简单了说就是 若本漏洞修复了，可以利用漏洞2 漏洞2修复了可以利用漏洞1 漏洞1影响范围更大一些 ------------------------------- 传送门 第一次http://wooyun.org/bugs/wooyun-2013-025053 第二次http://wooyun.org/bugs/wooyun-2013-025065 详细说明：...

Security Bypass Vulnerability in extension powermail (powermail)

It has been discovered that the extension "powermail" powermail is susceptible to Security Bypass Vulnerability. Release Date: June 03, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.6.9 and below, 2.0.1 -...

ecshop绕过验证码暴利破解

简要描述： 应该流行的版本都存在此问题 详细说明： 若验证码不匹配，并没有销毁当前验证码 所以就可以一次请求验证码图片后，只要不再刷新验证码就可以一直使用 漏洞证明： 1.获取正确的验证码 2. $url, CURLOPTHEADER = false, CURLOPTTIMEOUT= 0.11, //CURLOPTFILE=$f, CURLOPTRETURNTRANSFER=true, CURLOPTREFERER=$referer, //CURLOPTPOST=1, CURLOPTHTTPHEADER=array'Content-Type:...

ecshop设计缺陷.会员账号可暴力破解

简要描述： 乌云上面很多都是爆破验证码..怎么没人发爆破账号密码的... 详细说明： 在www.ecshop.cn 做的测试 登陆口连个简单的验证码都没有设置...一些网站的管理后台也有没验证码.这样就可以爆破了.先拿会员账号做个测试... 漏洞证明： img src="https://images.seebug.org/upload/201305/3009142831689f1beb4c45937af23a32a3389e7a.jpg" alt="1.jpg" widt...

WordPress Securimage 3.2.4 Cross Site Scripting Vulnerability

WordPress Securimage plugin version 3.2.4 suffers from a cross site scripting vulnerability. Wordpress Securimage-WP Plugin v3.2.4 URI-based XSS Vulnerability Vendor: Securimage PHP CAPTCHA Product web page: https://wordpress.org/extend/plugins/securimage-wp/ Affected version: 3.2.4 Summary:...

CVE-2013-3535

Multiple cross-site scripting XSS vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 adminemail, 2 headertitle, 3 sitetitle parameter to admin/settings; 4 recaptchaprivate or 5 recaptchapublic parameter to admin/captchasettings; 6...