2566 matches found
CVE-2017-11717: Authentication Bypass by Spoofing
MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page...
MetInfo has a logic flaw
MetInfo is a Content Management System CMS developed using PHP and Mysql. A logic vulnerability exists in MetInfo 5.3.17 and earlier versions. A remote attacker can exploit this vulnerability by changing the data flow between client servers to bypass captcha...
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...
Session fixation
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...
CVE-2017-7673
Apache OpenMeetings 1.0.0 is affected by CVE-2017-7673 due to weak cryptographic storage and missing brute-force protection in authentication-related forms, with registration and password-reset flows lacking captcha. Connected docs confirm the vulnerability details but do not provide a remediatio...
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...
PT-2017-17876
Name of the Vulnerable Software and Affected Versions Apache OpenMeetings version 1.0.0 Description The issue concerns the use of weak cryptographic storage in Apache OpenMeetings. Additionally, the registration and forget password dialogs lack captcha, and authentication forms do not have brute...
Mail.ru: BruteForce Any [My.com] Account Credentials.
CAPTCHA entered on account.my.com was not actually checked. account.my.com has no relation to My.Com's MyMail and is not currently covered by regular Mail.Ru bug bounty program...
Nanjing Palm Public Transportation APK has CAPTCHA Leakage Vulnerability
Nanjing Palm Bus is jointly created by Nanjing Public Transportation Group Co., Ltd. and Jiangsu Provincial Radio and Television Station Group. It is the only palmtop intelligent integrated service platform in Nanjing that collects real-time bus location inquiry, local news, live mobile TV and...
Password Breaches Fueling Booming Credential Stuffing Business
The market for credential stuffing software and services is thriving thanks in large part to an epidemic of breaches of usernames and passwords. Digital Shadows said today in a new report that credential leaks, such as this past month’s Anti Public Combo List and others, have buoyed the market fo...
Allen Disk Security Bypass Vulnerability
Allen Disk is a free, open source cloud-based hard disk product that features encrypted file storage, online preview, file sharing and more. A security bypass vulnerability exists in the reg.php file in Allen Disk version 1.6. An attacker can exploit this vulnerability to bypass CAPTCHA with the...
PT-2017-15230
Name of the Vulnerable Software and Affected Versions Captcha versions prior to 4.3.0 Car Rental versions prior to 1.0.5 Contact Form Multi versions prior to 1.2.1 Contact Form versions prior to 4.0.6 Contact Form to DB versions prior to 1.5.7 Custom Admin Page versions prior to 0.1.2 Custom Fiel...
CVE-2017-2171: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...
CVE-2017-9091
/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...
CVE-2017-9090
reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...
Design/Logic Flaw
/admin/loginc.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code' == 1, which leads to CAPTCHA bypass by emptying $POST'captcha'...
Design/Logic Flaw
reg.php in Allen Disk 1.6 doesn't check if isset$SESSION'captcha''code'==1, which makes it possible to bypass the CAPTCHA via an empty $POST'captcha'...