Shenzhen Jiya Technology Co., Ltd Jiya APP has information leakage vulnerability

JIYA APP is a cell phone housing search life application that includes new and second-hand housing functions. CAPTCHA Information Leakage: This vulnerability is mainly in the login and password retrieval, the server will return the verification code to the client, thus causing the leakage of...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

Shanghai Pu Ding Culture Communication Co.

Tiger Tour is a self-guided tour service platform founded and operated by Shanghai Purding Culture Communication Co. Ltd. Tiger Tours APP has an SMS bombing vulnerability, the vulnerability stems from the failure of the server side to limit the number of times and time of CAPTCHA requests for the...

WordPress Ajax BootModal Login plugin <= 1.4.3 - CAPTCHA reuse vulnerability

CAPTCHA reuse required only once per user session vulnerability found by Lydéric Lefebvre and Fabien Haureils in WordPress Ajax BootModal Login plugin versions = 1.4.3. Solution 2018.09.01 - we were unable to find a patched version of this plugin...

PHPOKCMS has a logical design flaw

PHPOKCMS is an enterprise station CMS system developed in PHP+MYSQL language. A logical design vulnerability exists in PHPOKCMS. Attackers can log in to other accounts by grabbing packets and blasting CAPTCHA...

Bypass Protection Mechanism

phpMyFAQ/phpMyFAQ is vulnerable to bypassing protection mechanism. Due to the flaw in Captcha implementation, an attacker can bypass the Captcha protections on forms by replaying the request...

CVE-2014-6050

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...

Cross site request forgery (csrf)

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...

CVE-2014-6050

CVE-2014-6050 affects phpMyFAQ prior to 2.8.13 and allows remote attackers to bypass CAPTCHA protection by replaying the request. NVD describes CAPTCHA bypass; Veracode notes bypass of form protections via replay. Documented impact is bypass of CAPTCHA on forms; no remediation details are provide...

CVE-2014-6050

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request...

CVE-2018-15876

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

CVE-2018-15876

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

Design/Logic Flaw

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

CVE-2018-15876

An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished...

CVE-2018-15876

The CVE-2018-15876 issue affects the WordPress plugin ajax-bootmodal-login (version 1.4.3). The register, login, and password-recovery forms require solving a CAPTCHA, but the CAPTCHA is enforced only once per user session, enabling automated requests to be sent repeatedly and potentially brute-f...

Ajax BootModal Login <= 1.4.3 - Captcha Reuse

The Ajax BootModal Login WordPress plugin was affected by a Captcha Reuse security vulnerability...

Logic design flaws in Guangzhou reference app

Guangzhou Reference APP is a new media brand created by Guangzhou Daily Newspaper Group, which is an information platform. There is a logical design vulnerability in Guangzhou Reference APP. An attacker can reset any password and perform unauthorized operations by grabbing packets and blasting...

D-Link DIR601 2.02 - Credential Disclosure

D-Link DIR601 2.02 - Credential Disclosure Exploit title: D-Link DIR601 2.02NA - Credential disclosure Date: 2018-07-10 Exploit Author: Richard Rogerson Vendor Homepage: http://ca.dlink.com/ Software Link: http://support.dlink.ca/ProductInfo.aspx?m=DIR-601 Version: = 2.02NA Tested on: D-Link DIR6...

D-Link DIR601 2.02 Credential Disclosure

Exploit title: D-Link DIR601 2.02NA - Credential disclosure Date: 2018-07-10 Exploit Author: Richard Rogerson Vendor Homepage: http://ca.dlink.com/ Software Link: http://support.dlink.ca/ProductInfo.aspx?m=DIR-601 Version: = 2.02NA Tested on: D-Link DIR601 Firmware 2.02NA Contact:...