CVE-2017-9090

The CVE-2017-9090 issue affects Allen Disk 1.6’s reg.php, where there is no proper check of isset($_SESSION['captcha']['code']), enabling bypass of CAPTCHA via an empty $_POST['captcha']. The vulnerability is documented across multiple feeds (NVD entry with CVSSv2/3 scores indicating low–high imp...

Weblate: Captcha bypass at registration

Affected URL: https://demo.weblate.org/accounts/register/ Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above UR...

Weblate: Captcha Bypass at Email Reset can lead to Spamming users.

Because of 223525 you've implemented captcha on Reset Email functionality. But it can be bypassed and any attacker can flood/spam victim with reset emails in his Email Inbox...

WordPress BestWebSoft Captcha Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A cross-site scripting vulnerability exists ...

CVE-2017-2150

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

Directory traversal

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

Weblate: Rate Limit Bypass on login Page

Hi, Your web authentication endpoint, https://demo.weblate.org/accounts/login/ POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, i...

Weblate: Bypassing captcha in registration on Hosted site

Hello again, I believe the captcha on the user registration form is very simple and can be easily bypassed to automatically register any number of accounts. A program can read the math captcha, solve it and submit the form with the answer and the other required parameters & headers. Note: I read...

Weblate: User Enumeration when adding email to account

It is possible to find all the Register emails which can be use for spam or other purposes csrfmiddlewaretoken token can be used more than one. All Register Email can be found by just brute force attack. Your web endpoint https://demo.weblate.org/accounts/email/ when changing email after login...

Weblate: Spamming any user from Reset Password Function

It is possible to spam any user whose email-id is known. csrfmiddlewaretoken token can be used more than one. Users can be spammed heavily by just Brute force attack on password reset page. Implementtion: Implement a Captcha...

Weblate: Registration captcha bypass

Hello, I've found that it is possible to bypass captcha during registration. Attacker can automatize registration process and create multiple accounts. Here are steps to reproduce: 1. Go to registration page. Type information and catch request in proxy. 2. Get correct answer for captcha and captc...

BAIC's Android app has a CAPTCHA design flaw

BAIC Android app is an online mobile service software. A CAPTCHA design vulnerability exists in the BAIC Android app. The vulnerability is caused due to the captcha being transmitted in clear text and without conditional restrictions. With the password recovery feature, an attacker can continuous...

Unauthorized Access Vulnerability in Rigel Psychoeducation Information Management System of Beijing Otay Rigel Technology Co.

Rigel Psychoeducational Information Management System is a content management system for information collection and analysis. An unauthorized access vulnerability exists in the Riggs Psychoeducational Information Management System. The vulnerability occurs because the '/sysManage/Excel/' director...

CAPTCHA Detection

Detects any known CAPTCHA products being used on a page. No source data...

Fraudsters Using GiftGhostBot Botnet to Steal Gift Card Balances

Gift cards have once again caused quite a headache for retailers, as cyber criminals are using a botnet to break into and steal cash from money-loaded gift cards provided by major retailers around the globe. Dubbed GiftGhostBot, the new botnet specialized in gift card fraud is an advanced...

Cross-site Scripting (XSS)

jquery-validation is vulnerable to cross-site scripting XSS attacks. The vulnerability is due to a flaw in demo/captcha. All the websites which use this jquery plugin to perform easy form validation functionality are affected...

Rockstar Games: Bypass CAPTCHA protection

In this report, the researcher found that it was possible to bypass our CAPTCHA check by injecting a random value into the X-Forwarded-For header in the sign in POST request. At the time the researcher submitted this report, we only enforced CAPTCHA checks on sign-in requests that had failed...

Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...

Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...

LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)

Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumption from the server by abusing the captcha servlet Description: By sending a specially crafted request and changing the height/width parameters in the captcha form it is possib...