WordPress Best Web Soft Captcha 4.1.5 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: BWS Captcha Multiple Vulnerabilities Discovery Date:12.03.2015 Public Disclosure Date:03.10.2016 Exploit Author: Colette Chamberland Contact: email protected Vendor Homepage: http://bestwebsoft.com/ Software Link:...

Magento CMS has multiple vulnerabilities

Magento is a professional open source PHP e-commerce system of the United States Magento company.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. Magento CE and EE in the existence of HTML injection vulnerabilities , brute-force cracking...

Veris: Password(s) can be found via login process.

Hello security team, It is possible to find passwords of other users by enumerate the login process. The scenario is quiet simple: 1 Go to https://sandbox.veris.in/portal/login/ 2 Fill in 'Email ID' and 'Password' and click 'Log In' 3 Capture the request via burp suite and send it to intruder. 4...

forum.sohagame.vn XSS vulnerability

Vulnerable URL: http://forum.sohagame.vn/captcha/captcha.php?callback=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:10 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

phpwind V9.0 /windid/admin.php 验证码绕过漏洞

No description provided by source...

Mail.ru: Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing

Hi Mail.ru, I was surfing in your website and i was trying to find a Reflected Cross-site Scripting Vulnerability , So i was trying to find a way to inject my payload in a LINK . While Surfing i've found this link : https://pw.mail.ru/validate/index.html?refurl=pw.mail.ru Screenshot :...

Ovidentia Captcha (Version 0.7) Module Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Title: Ovidentia Module Captcha Version 0.7 Remote File Inclusion Author: GoLdM Download: http://www.ovidentia.org/modules/babArticle731 PoC : \captcha-0-7\programs\captcha.class.php ------------------------------------------------------...

WordPress Captcha 4.0.2 Cross Site Scripting

Plugin Name : Captcha Effected Version : 4.0.2 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept :...

WordPress Google Captcha 1.05 Cross Site Scripting

Plugin Name : Google Captcha reCAPTCHA Effected Version : 1.05 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the...

Zend Framework CAPTCHA Challenge Insufficient Entropy Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. An insufficient entropy vulnerability exists in ZF. An attacker can exploit this vulnerability to obtain sensitive...

Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

More info at https://framework.zend.com/security/advisory/ZF2015-09...

Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

More info at https://framework.zend.com/security/advisory/ZF2015-09...

FreeBSD : codeigniter -- multiple vulnerabilities (698403a7-803d-11e5-ab94-002590263bf5)

The CodeIgniter changelog reports : Fixed an XSS attack vector in Security Library method xssclean. Changed Config Library method baseurl to fallback to $SERVER'SERVERADDR' in order to avoid Host header injections. Changed CAPTCHA Helper to try to use the operating system's PRNG first...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Fixed an XSS attack vector in Security Library method xssclean. Changed Config Library method baseurl to fallback to $SERVER'SERVERADDR' in order to avoid Host header injections. Changed CAPTCHA Helper to try to use the operating system's PRNG first...

Whisper: SMS Invite Form Abuse

whisper.sh fails to protect the invite form from abuse from attackers. If a malicious individual wants to abuse this functionality, they could send repeated/automated requests to the same phone number or range of phone numbers that do no actually belong to himself. This would result in lots of...

ecshop V2.7.3 验证码绕过逻辑漏洞

No description provided by source...

BitHunt: No rate limit or captcha to identify humans

HI, There is no captcha or rate limit to protect from bots against adding request for new products. Check image attached for 20 request sent one after the other with 200 OK status...

plone -- multiple vulnerabilities

Plone.org reports: Versions Affected: All current Plone versions. Versions Not Affected: None. Nature of vulnerability: Allows creation of members by anonymous users on sites that have self-registration enabled, allowing bypass of CAPTCHA and similar protections against scripted attacks. The patc...

WordPress Altos Connect Widget Plugin <= 1.3.0 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because "PHPSELF" is printed without sanitization in a captcha demo page. Solution Update the plugin...

VK.com: Issue in the implementation of captcha and race condition

Reuse of captcha. The researcher was able to find a misconfiguration in the captcha mechanism which allowed him to reuse any captcha and bypass the uniquness of the same . Furthermore the race condition bypassed the no. of retries...