D-Link DIR601 2.02 - Credential Disclosure

Exploit title: D-Link DIR601 2.02NA - Credential disclosure Date: 2018-07-10 Exploit Author: Richard Rogerson Vendor Homepage: http://ca.dlink.com/ Software Link: http://support.dlink.ca/ProductInfo.aspx?m=DIR-601 Version: = 2.02NA Tested on: D-Link DIR601 Firmware 2.02NA Contact:...

D-Link DIR601 2.02 - Credential Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit title: D-Link DIR601 2.02NA - Credential disclosure Exploit Author: Richard Rogerson Vendor Homepage: http://ca.dlink.com/ Software Link: http://support.dlink.ca/ProductInfo.aspx?m=DIR-601 Version: = 2.02NA Tested on: D-Link DIR60...

CVE-2018-12103

An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices all hardware revisions. Due to the predictability of the /docs/captchanumber.jpeg URI, being local...

CVE-2018-12103

An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices all hardware revisions. Due to the predictability of the /docs/captchanumber.jpeg URI, being local...

CVE-2018-12103

The CVE-2018-12103 issue affects D-Link DIR-890L (firmware ≤ 1.21B02beta01), DIR-885L/R (≤ 1.21B03beta01), and DIR-895L/R (≤ 1.21B04beta04). The root cause is the predictable, locally accessible /docs/captcha_(number).jpeg URI in the administrator panel, which an attacker can leverage to disclose...

D-Link DIR-890L A2 Improper Access Control Vulnerability

D-Link DIR-890L is a wireless router product from AUO D-Link. The D-Link DIR-890L A2 suffers from an Improper Access Control vulnerability that, due to the predictability of the /docs/captchanumber.jpeg URI, allows an attacker to disclose the CAPTCHA used by the access point and optionally load t...

Liberapay: No Data Validation, No Captcha, No Filters...

POST /for/new HTTP/1.1 Host: liberapay.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:52.0 Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...

PT-2018-3888 · D Link · D-Link Dir-895L/R +2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-890L versions 1.21B02beta01 and earlier D-Link DIR-885L/R versions 1.21B03beta01 and earlier D-Link DIR-895L/R versions 1.21B04beta04 and earlier Description: The issue is related to the predictability of the "/docs/captcha...

CVE-2012-10021

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlinkdir605lcaptchabof.rb 2025-10-23 21:12:56+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

Kangaroo Life App has a Bursting Vulnerability

Kangaroo Life App is a mobile lending software. Kangaroo Life APP has a blasting vulnerability. Attackers can log in to any account by grabbing packets and blasting CAPTCHA...

Youxin Used Car App Has Logic Design Flaws

Youxin Used Car APP is a cell phone used car information buying service software. There is a logical design vulnerability in Ushin Used Car APP. Attackers can bombard the client with SMS messages by replaying packets that send CAPTCHA without restriction...

Happy Kangaroo App has SMS Bombing Vulnerability

Happy Kangaroo App is a financial app. There is an SMS bombing vulnerability in Happy Kangaroo APP. An attacker can exploit this vulnerability to replay packets sending CAPTCHA without restriction and bombard the client with SMS messages...

Honeypot strategy is no longer effectively preventing spam account signup

panel:title=Fix From 3.9.5 onwards we have turned off the honeypot in favour of using captcha anyone affected by this issue just needs to switch the CAPTCHA on...

Honeypot strategy is no longer effectively preventing spam account signup

panel:title=Fix From 3.9.5 onwards we have turned off the honeypot in favour of using captcha anyone affected by this issue just needs to switch the CAPTCHA on...

Logic design flaws in Anju App

Anjuke APP is a domestic real estate rental and sale service platform. A logical design vulnerability exists in Anjuke APP. An attacker can exploit this vulnerability to consume server resources and cause denial of service by sending unlimited CAPTCHAs to cell phones...

Used Car Home App Has SMS Bombing Vulnerability

Used Car Home App is a mobile application platform that helps users to buy and sell used cars. The Used Car House APP version 6.1.4 suffers from an SMS bombing vulnerability that allows an attacker to traverse a cell phone number and consume server resources and cause a denial of service by sendi...

angular-rome (>=0.2.4 <=0.2.9), api-gate (>=0.0.8 <=0.0.14) +74 more potentially affected by CVE-2018-3721 via lodash._basemerge (>=2.0.0 <=2.4.1)

lodash.basemerge NPM version =2.0.0, =0.2.4, =0.0.8, =0.1.2, =0.5.0, =0.0.3, =0.0.2, =0.0.0, =0.1.3, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =1.0.18, =1.1.16 and more Source cves: CVE-2018-3721 Source advisory: SNYK:JS-LODASHBASEMERGE-450201...

140.127.202.12 XSS vulnerability

Open Bug Bounty ID: OBB-484372 Description| Value ---|--- Affected Website:| 140.127.202.12 Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure base...

uncaptcha - Defeating Google's audio reCaptcha with 85% accuracy

Defeating Google's audio reCaptcha system with 85% accuracy. Inspiration Across the Internet, hundreds of thousands of sites rely on Google's reCaptcha system for defense against bots in fact, Devpost uses reCaptcha when creating a new account. After a Google research team demonstrated a near...

Logic Design Vulnerability in Catfish CMS/Blog System Logins

Catfish catfish CMS is open source PHP content management system. A logical design vulnerability exists in the Catfish CMS/Blog system login. Allow attackers to exploit the vulnerability to bypass the CAPTCHA authentication and carry out unlimited blasting attacks on the system...