WordPress All In One WP Security & Firewall Plugin <= 4.1.2 - Multiple Vulnerabilities

There are multiple vulnerabilities in in login CAPTCHA. Because of them, attackers can automate login attempts when the CAPTCHA is enabled. Solution Update the plugin...

All In One WP Security & Firewall <= 4.1.2 - Multiple vulnerabilities in login CAPTCHA

The All In One WP Security & Firewall WordPress plugin was affected by a Multiple vulnerabilities in login CAPTCHA security vulnerability...

Securimage 'example_form.ajax.php' cross-site scripting vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA codes.' A cross-site scripting vulnerability exists in Securimage. An attacker can exploit this vulnerability to execute arbitrary script code, steal cookie-based authentication and launch other...

██████: Cross-site request forgery vulnerability resulting in the deletion of a user's account.

One of the first cross-site request forgery vulnerabilities that I discovered on █████ allowed me to delete an unsuspecting user's account. In order to exploit this issue, I crafted a simple HTML form that sent a POST request to the /unregister endpoint when a user loaded the malicious page. html...

Nextcloud: No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers

The lack of a captcah or verificationcodeX it's empty in your phplist configuration allows attackers to use this mail for to send as much spam as they like to victims. I did not reach an email sending limit when I had tested this. PoC images below: Burp suite automated requests:...

HackerOne: Denial of service in report view.

Hello Team! First of all thank you for acknowledging my feature request, I know it will help a lot of users. Description: ========== I just wanted to report a potential vulnerability on the report view functionality. For obvious reasons I'm using my sandboxed team on an alternate account to test...

Securimage Cross-Site Scripting Vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA code. Securimage suffers from a cross-site scripting vulnerability that could allow an attacker to execute arbitrary JavaScript code in a user's browser...

[SECURITY] Fedora 24 Update: python-tgcaptcha2-0.3.1-1.fc24

TGCaptcha2 is a TurboGears widget that provides an easy way to incorporate a captcha as part a form in an attempt to reduce spam or malicious activity. Features include: Relatively pain-free usage and validation inside of a regular widget-based form Flexibility to add or extend image generation...

WordPress Captcha Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Captcha Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

AWS CAPTCHA Bypass

The process of AWS login has a feature: if you use "fresh" browserno cookie, no cache, etc to sign in, put correct email and correct password there, CAPTCHA is required"To better protect your account, please re-enter your password and then enter the characters as they are shown in the image below...

[SECURITY] Fedora 23 Update: python-tgcaptcha2-0.3.1-1.fc23

TGCaptcha2 is a TurboGears widget that provides an easy way to incorporate a captcha as part a form in an attempt to reduce spam or malicious activity. Features include: Relatively pain-free usage and validation inside of a regular widget-based form Flexibility to add or extend image generation...

[SECURITY] Fedora 22 Update: python-tgcaptcha2-0.3.1-1.fc22

TGCaptcha2 is a TurboGears widget that provides an easy way to incorporate a captcha as part a form in an attempt to reduce spam or malicious activity. Features include: Relatively pain-free usage and validation inside of a regular widget-based form Flexibility to add or extend image generation...

Wordpress SI CAPTCHA AntiSpam 插件-test/index.php-跨站脚本漏洞

No description provided by source...

Gratipay: An adversary can harvest email address for spamming.

The website is displaying email address. These email address can be harvested by automated programs called bots and then used as a target for spamming. 1. Use any Email extractor tool or Add on. Here I have used Chrome Email Extractor Add on offered by Mr. Alien. 2. In Browser open...

New Relic: Old CAPTCHA offers no protection

To rate-limit users, you use an old CAPTCHA method that has been broken for quite a while due to developments in OCR. There are many services that are available to quickly solve these and so it offers no protection. For example, here is one site that offers easy CAPTCHA breaking:...

Securimage Cross-Scripting Vulnerability

Securimage is an open source PHP CAPTCHA script for generating CAPTCHA images and CAPTCHA code . Securimage suffers from a cross-scripting vulnerability. An attacker exploits the vulnerability to inject arbitrary JavaScript code via a specially crafted URL, resulting in a cross-site scripting XSS...

Securimage 3.6.2 Cross Site Scripting

Advisory: Cross-site Scripting in Securimage 3.6.2 RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the Securimage CAPTCHA software, which allows attackers to inject arbitrary JavaScript code via a crafted URL. Details ======= Product: Securimage Affected Versions: = 3.2R...

Veris: Captcha Bypass enable login bruteforce

HI There is captcha bypass, which can lead to login credentials bruteforce attack. Just remove &g-recaptcha-response from request, and the server accepts your request. Please check the screenshots...

New Relic: No Rate Limitation on Promo Code

Hello, there is no rate limitation on entering "promo code" while upgrading the subscription. an attacker can bruteforce the promo code and could get a lot of benefits with that. https://rpm.newrelic.com/accounts/XXXXXXX/products i have tested this bug by attempting 500+ invalid promo code. and g...

WordPress Best Web Soft Captcha Plugin 4.1.5 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, such as XSS and CSRF. Because of that, an attacker can send admin a URL crafted for the example, http://wwww.victim.com/wp-admin/admin.php?page=captcha.php&action=whitelist&s=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E or send a form, that will...