in star7th/showdoc

Description - CWE: CWE-288:Authentication Bypass Using an Alternate Path or Channel - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L , CVSS Score: 8.3High - Credit：Qianxin, Network Security Department, Product-Safety Team Unc1e In showdoc, there is a SSO process , DOC is shown in...

CVE-2020-21865

ThinkPHP50-CMS v1.0 contains a remote code execution RCE vulnerability in the component /public/?s=captcha...

Remote code execution

ThinkPHP50-CMS v1.0 contains a remote code execution RCE vulnerability in the component /public/?s=captcha...

CVE-2020-21865

ThinkPHP50-CMS v1.0 contains a remote code execution RCE vulnerability in the component /public/?s=captcha...

PT-2021-10691

Name of the Vulnerable Software and Affected Versions: ThinkPHP50-CMS version 1.0 Description: The issue is related to a remote code execution RCE vulnerability in the component /public/?s=captcha. Recommendations: For ThinkPHP50-CMS version 1.0, as a temporary workaround, consider disabling the...

ThinkPHP50-CMS 代码问题漏洞

ThinkPHP50-CMS is a CMS based on ThinkPHP 5.0.18. A code issue vulnerability exists in ThinkPHP50-CMS that stems from improper implementation of functional logic in the product /public/?s=captcha link. An attacker could use this vulnerability to cause code execution. The following products and...

CVE-2020-21865: Undefined Security Weakness

ThinkPHP50-CMS v1.0 contains a remote code execution RCE vulnerability in the component /public/?s=captcha...

WordPress Contact Form 7 Captcha Plugin < 0.0.9 CSRF/XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Zoho ManageEngine ADSelfService Plus Input Validation Error Vulnerability (CNVD-2021-88251)

ZOHO zoho manageengine adselfservice plus is the United States zoho ZOHO company's set of Web-based end-user password management software . An input validation error vulnerability exists in Zoho ManageEngine ADSelfService Plus, which can be exploited by an attacker to cause a CAPTCHA bypass...

CVE-2021-37417

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-37417

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

Input validation

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-37417

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-37417

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-37417

CVE-2021-37417 affects Zoho ManageEngine ADSelfService Plus (version 6103 and earlier). The connected sources describe an input validation flaw that enables a CAPTCHA bypass, arising from improper parameter validation in the affected REST/web endpoints. The CVE is documented across multiple feeds...

CVE-2021-37417: Improper Authentication

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

zoho manageengine adselfservice plus 授权问题漏洞

ZOHO zoho manageengine adselfservice plus is the United States zoho ZOHO company's set of Web-based end-user password management software . An input validation error vulnerability exists in Zoho ManageEngine ADSelfService Plus, which can be exploited by an attacker to cause a CAPTCHA bypass...

PT-2021-21641

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6103 Description The issue is related to CAPTCHA bypass due to improper parameter validation. Recommendations For versions prior to 6103, update to a version newer than 6103 to resolve the...

Microsoft Warns of Widespread Phishing Attacks Using Open Redirects

Microsoft is warning of a widespread credential phishing campaign that leverages open redirector links in email communications as a vector to trick users into visiting malicious websites while effectively bypassing security software. "Attackers combine these links with social engineering baits th...

Microsoft warns about phishing campaign using open redirects

The Microsoft 365 Defender Threat Intelligence Team posted an article stating that they have been tracking a widespread credential phishing campaign using open redirector links. Open redirects have been part of the phisher’s arsenal for a long time and it is a proven method to trick victims into...