Janusec Application Gateway - Tool Which Provides WAF, CC Attack Defense, Unified Web Administration Portal, Private Key Protection, Web Routing And Scalable Load Balancing

Janusec Application Gateway, an application security solutions which provides WAF Web Application Firewall, unified web administration portal, private key protection, web routing and scalable load balancing. With Janusec, you can build secure and scalable applications. Key Features WAF Web...

Smule: Missing Rate Limit in Forgot Password can Lead to email address leakage of all smule accounts

Hello Smule, I have found a vulnerability by which an attacker can get access of all the gmail accounts associated with Smule. The forgot password parameter can be brute forced through which an attacker can get the email address. Steps to Reproduce Enter your email address and for the forgot...

Captcha doesn't work for page preview comment

Steps to reproduce: go to Configuration - Spam Prevention turn on Captcha for everyone create a page with image click the image to preview try to make a comment on the image Expected: User needs to enter the captcha to submit the comment Actual: User can submit the comment without entering the...

Captcha not checked for page creation

Steps to reproduce: Turn on Captcha from Configuration - Spam Prevention Select "No one everyone will see captchas" and save Create a page should see the captcha Publish the page without entering the captcha Expected: Publish is not allowed Actual: Page is published...

Pagoda Linux panel cross-site scripting vulnerability

Pagoda Linux panel is a Linux hosting panel from China Pagoda Pagoda Network Technology Company. A cross-site scripting vulnerability exists in Pagoda Linux panel version 6.0. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML via a CAPTCHA associated...

GHSA-8Q89-PWHH-7WFQ Use of Insufficiently Random Values in penggle:kaptcha

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

Design/Logic Flaw

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

CVE-2018-18531

CVE-2018-18531 involves kaptcha 2.3.2, where files text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java use Random instead of SecureRandom to generate CAPTCHA values. This weak randomness can enable remote attackers to brute-forc...

cn.hutool:hutool-aop (>=4.0.0 <=4.1.11), cn.hutool:hutool-bloomFilter (>=4.0.0 <=4.1.11) +79 more potentially affected by CVE-2018-17297 via cn.hutool:hutool-core (>=4.0.0 <=4.1.11)

cn.hutool:hutool-core MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.11 and more Source cves: CVE-2018-17297 Source advisory: OSV:GHSA-RHQ2-2574-78MC...

LG SuperSign CMS Authentication Bypass Vulnerability

LG SuperSign CMS is a content management system for LG webOS from the Luckin LG Group in Korea. The system supports connection to external databases and allows access to the server from mobile devices. An authentication bypass vulnerability exists in LG SuperSign CMS, which can be exploited by an...

Information leakage vulnerability in Dr. Fannie's Broker APP of Guangzhou Live World Network Co.

Dr. Housing Broker - mobile home selling, home price checking, commission checking, showing, customer reporting, customer management, convenient and real. CAPTCHA Information Leakage: This vulnerability mainly occurs when registering and retrieving passwords, the server will return the CAPTCHA to...

Qinhuangdao Kusoft Information Technology Co., Ltd. on Meijia takeout APP has information leakage vulnerability

Shangmeijia focuses on providing online ordering and delivery services of catering food and specialty quality takeout for urban residents. CAPTCHA Information Leakage: This vulnerability mainly occurs when registering and retrieving passwords, the server will return the CAPTCHA to the client, thu...

Tianjin Jin Yi Fang Network Information Technology Co., Ltd. Yi Fang Network APP has information leakage vulnerability

Bfang.com app is the exclusive software for registered users of Tianjin Bfang.com. Covering a wealth of real estate, houses, high-rise, villas, SOHO, stores. CAPTCHA information leakage: This vulnerability is mainly in the registration, the server will return the verification code to the client,...

Authentication flaw

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...

CVE-2018-16286

LG SuperSign CMS suffers an authentication bypass: if a captcha:pass cookie is present and the PIN is limited to four digits, CAPTCHA is skipped and access can be gained without proper authentication. Multiple sources (NVD/NVD-derived records and CNVD) describe this flaw and its impact; CVSS metr...

CVE-2018-16286

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...

Monstra CMS HTTP Header Injection Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An HTTP header injection vulnerability exists in the 'cfg' parameter of the...

There is an information leakage vulnerability in the APP of Beijing JIANNONG Online Information Technology Co.

KANO Online Layer Manager is a national informatization service platform for the egg industry and is a networked production management software platform for egg farms. The application has CAPTCHA information leakage: when registering and retrieving passwords, the server side returns the CAPTCHA t...