Drupal Module CAPTCHA - Security Bypass

source: https://www.securityfocus.com/bid/46344/info The CAPTCHA module for Drupal is prone to a security-bypass vulnerability that occurs in the CAPTCHA authentication routine. Successful exploits may allow attackers to bypass the CAPTCHA-based authentication routine, allowing attackers to perfo...

Drupal CAPTCHA Logic Security Flaw

Drupal Captcha bruteforcing bypass This is a Proof Of Concept to demonstrate a logic security flow in the way drupal captcha is used to protect login forms from bruteforce. If the captcha challenge is solved, the next login attempts can be issued without solving any new captcha challenge. Usage:...

User Enumeration

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that at least two vulnerabilities regarding User Enumeration were found within the software. Case 1: Logged In Whenever a logged user accesses the Url...

User Enumeration

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that at least two vulnerabilities regarding User Enumeration were found within the software. Case 1: Logged In Whenever a logged user accesses the Url...

User Enumeration

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that at least two vulnerabilities regarding User Enumeration were found within the software. Case 1: Logged In Whenever a logged user accesses the Url...

DHS: $40m To Research Next Big Thing in Cyber Security

The U.S. Department of Homeland Security issued a call for proposals this week in a $40m program to encourage research and development in a wide range of topics related to cyber security: from designing more resilient software, to alternatives to passwords and CAPTCHA technology to prevent...

Facebook Announces Social Verification and HTTPS option

Facebook announced yesterday that they will begin offering secure HTTPS connections and a new verification method called social verification to users of the most popular social network in the world. The move comes, conveniently, just a day after Facebook CEO and founder Mark Zuckerberg’s personal...

Joomla Captcha Plugin <= 4.5.1 Local File Disclosure Vulnerability

Exploit for php platform in category web applications Joomla Captcha Plugin 0 95 for $i = 0; $i $captchalength; $i++ 96 $soundfiles$i = 'files/' . $lng . '.' . strtolower substr $captchacode, $i, 1 . '.mp3'; /...

Joomla! Plugin Captcha 4.5.1 - Local File Disclosure

Joomla! Plugin Captcha 4.5.1 - Local File Disclosure :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com Joomla Captcha Plugin = 4.5.1 Local File Disclosure Vulnerability Script:...

Joomla! Plugin Captcha 4.5.1 - Local File Disclosure

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com Joomla Captcha Plugin 0 95 for $i = 0; $i...

OpenClassifieds 1.7.0.3 Chained: Captcha Bypass / SQLi / Persistent XSS

Exploit for php platform in category web applications Author:Michael Brooks Rook Application:OpenClassifieds 1.7.0.3 download: http://open-classifieds.com/download/ Exploit chain:captcha bypass-sqliinsert-persistant xss on front page If registration is required an extra link in the chain is added...

Multiple Vulnerabilities in OpenClassifieds 1.7.0.3

I understand that this is a vain hope that bugtraq will start posting something useful. Author:Michael Brooks Rookbr Application:OpenClassifieds 1.7.0.3br download: http://open-classifieds.com/download/br Exploit chain:captcha bypass-sqliinsert-persistant xss on front pagebr If registration is...

OpenClassifieds 1.7.0.3 - Chained: Captcha Bypass SQL Injection Persistent Cross-Site Scripting on FrontPage

OpenClassifieds 1.7.0.3 - Chained: Captcha Bypass SQL Injection Persistent Cross-Site Scripting on FrontPage Author:Michael Brooks Rook Application:OpenClassifieds 1.7.0.3 download: http://open-classifieds.com/download/ Exploit chain:captcha bypass-sqliinsert-persistant xss on front page If...

OpenClassifieds 1.7.0.3 - Chained: Captcha Bypass / SQL Injection / Persistent Cross-Site Scripting on FrontPage

Author:Michael Brooks Rook Application:OpenClassifieds 1.7.0.3 download: http://open-classifieds.com/download/ Exploit chain:captcha bypass-sqliinsert-persistant xss on front page If registration is required an extra link in the chain is added: Exploit chain:blind sqliselect-captcha...

OpenClassifieds 1.7.0.3 Chained: Captcha Bypass -> SQL Injection -> XSS on Frontpage

Author:Michael Brooks Rook Application:OpenClassifieds 1.7.0.3 download: http://open-classifieds.com/download/ Exploit chain:captcha bypass-sqliinsert-persistant xss on front page If registration is required an extra link in the chain is added: Exploit chain:blind sqliselect-captcha...

OpenAuto 1.6.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS...

openauto 1.6.3 - Multiple Vulnerabilities

Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a onclick event handler...

openauto 1.6.3 - Multiple Vulnerabilities

openauto 1.6.3 - Multiple Vulnerabilities Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a...

Cforms & CformsII <= 14.10.1 - CAPTCHA Bypass

The cformsII plugin slug: cforms and its fork slug: cforms2 have a CAPTCHA Bypass vulnerability. The MD5 hash for matching the answer is sent with the forms and so it can be overwritten. This is fixed in the fork cforms2 with version 14.11 see changelog for confirmation. The original delicious:da...

Apache Archiva 1.0 < 1.3.1 - Cross-Site Request Forgery

ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 + Versions: Archiva 1.0 to 1.3.1 + Date: 29/09/2010 +...