CVE-2016-8600

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

CVE-2016-8600: Undefined Security Weakness

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later...

PT-2016-7517

Name of the Vulnerable Software and Affected Versions dotCMS version 3.2.1 Description The issue allows an attacker to bypass the captcha check by loading the captcha once, filling it with the correct value, and then reusing this correct value for subsequent forms that have a captcha check...

TGCaptcha2 Replay Attack Vulnerability

TGCaptcha2 is a suite of tools that provide a reduction in spam or malicious activity by combining CAPTCHAs as a single form. A replay attack vulnerability exists in TGCaptcha2 version 0.3.0. An attacker can exploit the vulnerability to use the same CAPTCHA an unlimited number of times...

Cross-site scripting vulnerability in wordpress plugin contact-form-with-captcha

Contact Form With Captcha is a Wordpress plugin with CAPTCHA plugin Contact Form allows users to access Wordpress blogs using Google CAPTCHA form, it requires PHP 5 or higher. Wordpress plugin contact-form-with-captcha suffers from an xss vulnerability due to improper filtering of user input, whi...

CVE-2016-1000032

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times...

CVE-2016-1000032

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times...

PT-2016-4496

Name of the Vulnerable Software and Affected Versions TGCaptcha2 version 0.3.0 Description The issue is related to a missing nonce, which enables attackers to reuse a single solved CAPTCHA multiple times, effectively bypassing the CAPTCHA's security mechanism. Recommendations For TGCaptcha2 versi...

dotCMS CAPTCHA Bypass Vulnerability

Exploit for php platform in category web applications Title: CVE-2016-8600 dotCMS - CAPTCHA bypass by reusing valid code Credit: Elar Lang / https://security.elarlang.eu Vulnerability: CAPTCHA bypass by re-using last loaded valid CAPTCHA code Vulnerable version: before 3.6.0 CVE: CVE-2016-8600...

Ian Dunn: No CAPTCHA ia exist in pages

No CAPTCHA is exist in the "Wordpress-backup-options" and "contact" pages. Due to the fact that the webpage has no CAPTCHA mechanism any attacker can perform DOS/DDOS attack and perform Daniel of Service attack to the server. Links: Wordpress-backup-options page:...

Magento Community Edition 2.x < 2.0.1 Multiple Vulnerabilities

Binary data 9692.prm...

Login CAPTCHA Bypass Vulnerability in AVTECH Device Login Parameter

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. There is a login authentication code bypass vulnerability in the login parameter of AVTECH devices. When the login request...

WordPress All-In-One Security / Firewall 4.1.2 CAPTCHA Bypass

------------------------------------------------------------------------ Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA ------------------------------------------------------------------------ Sipke Mellema, July 2016...

WordPress All In One WP Security and Firewall Plugin Login CAPTCHA Bypass

The login CAPTCHA provided by the WordPress All In One WP Security and Firewall Plugin can be circumvented, allowing attackers to automate login attempts when the CAPTCHA is enabled...

All In One WP Security & Firewall <= 4.1.2 - Multiple vulnerabilities in login CAPTCHA

The All In One WP Security & Firewall WordPress plugin was affected by a Multiple vulnerabilities in login CAPTCHA security vulnerability...

WordPress All In One WP Security & Firewall Plugin <= 4.1.2 - Multiple Vulnerabilities

There are multiple vulnerabilities in in login CAPTCHA. Because of them, attackers can automate login attempts when the CAPTCHA is enabled. Solution Update the plugin...

Securimage 'example_form.ajax.php' cross-site scripting vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA codes.' A cross-site scripting vulnerability exists in Securimage. An attacker can exploit this vulnerability to execute arbitrary script code, steal cookie-based authentication and launch other...

██████: Cross-site request forgery vulnerability resulting in the deletion of a user's account.

One of the first cross-site request forgery vulnerabilities that I discovered on █████ allowed me to delete an unsuspecting user's account. In order to exploit this issue, I crafted a simple HTML form that sent a POST request to the /unregister endpoint when a user loaded the malicious page. html...

Nextcloud: No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers

The lack of a captcah or verificationcodeX it's empty in your phplist configuration allows attackers to use this mail for to send as much spam as they like to victims. I did not reach an email sending limit when I had tested this. PoC images below: Burp suite automated requests:...

HackerOne: Denial of service in report view.

Hello Team! First of all thank you for acknowledging my feature request, I know it will help a lot of users. Description: ========== I just wanted to report a potential vulnerability on the report view functionality. For obvious reasons I'm using my sandboxed team on an alternate account to test...