Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...

LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)

Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumption from the server by abusing the captcha servlet Description: By sending a specially crafted request and changing the height/width parameters in the captcha form it is possib...

Starbucks: Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud

Summary: The pages https://www.starbucks.com/account/card/addcard and https://www.starbucks.com/account/card/Balance do not properly enforce security controls to limit POST requests. This bug allows attackers to successfully hijack a loaded Starbucks card and transfer all the funds into their own...

schoolbag.ru XSS vulnerability

Vulnerable URL: http://schoolbag.ru/my/s3/captcha/get.php?callback=prompt/OPENBUGBOUNTY/...

pmcomp.ru XSS vulnerability

Vulnerable URL: http://pmcomp.ru/my/s3/captcha/get.php?callback=prompt/OPENBUGBOUNTY/...

elstile.ru XSS vulnerability

Vulnerable URL: http://www.elstile.ru/my/s3/captcha/get.php?callback=prompt/OPENBUGBOUNTY/...

D-Link DIR-300NRUB5 Firmware 1.2.94 Cross Site Request Forgery

Hello list! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DIR-300. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DIR-300NRUB5, Firmware 1.2.94. All previous versions also must be...

CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

Code injection

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

CVE-2016-8600

dotCMS CAPTCHA bypass vulnerability (CVE-2016-8600) affects dotCMS 3.2.1, where the CAPTCHA code can be reused within the same session: after loading a CAPTCHA, an attacker can submit the form with that correct code for subsequent checks. Root cause: last loaded CAPTCH A code persists in the sess...

CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

PT-2016-7517

Name of the Vulnerable Software and Affected Versions dotCMS version 3.2.1 Description The issue allows an attacker to bypass the captcha check by loading the captcha once, filling it with the correct value, and then reusing this correct value for subsequent forms that have a captcha check...

CVE-2016-8600: Undefined Security Weakness

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

TGCaptcha2 Replay Attack Vulnerability

TGCaptcha2 is a suite of tools that provide a reduction in spam or malicious activity by combining CAPTCHAs as a single form. A replay attack vulnerability exists in TGCaptcha2 version 0.3.0. An attacker can exploit the vulnerability to use the same CAPTCHA an unlimited number of times...

Cross-site scripting vulnerability in wordpress plugin contact-form-with-captcha

Contact Form With Captcha is a Wordpress plugin with CAPTCHA plugin Contact Form allows users to access Wordpress blogs using Google CAPTCHA form, it requires PHP 5 or higher. Wordpress plugin contact-form-with-captcha suffers from an xss vulnerability due to improper filtering of user input, whi...

CVE-2016-1000032

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times...

CVE-2016-1000032

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times...

PT-2016-4496

Name of the Vulnerable Software and Affected Versions TGCaptcha2 version 0.3.0 Description The issue is related to a missing nonce, which enables attackers to reuse a single solved CAPTCHA multiple times, effectively bypassing the CAPTCHA's security mechanism. Recommendations For TGCaptcha2 versi...