hcaptcha-challenger

hCaptcha Challenger 🚀 Gracefully face hCaptcha challenge with multimodal large language model. Introduction Does not rely on any Tampermonkey script. Does not use any third-party anti-captcha services. Just implement some interfaces to make AI vs AI possible. Documentation: English | 简体中文 | Русск...

fpx (>=0.4.0, <=0.4.9), hcaptcha-challenger (>=0.4.2, <=0.4.2.1) +4 more potentially affected by CVE-2026-85078 via sanic (22.6.2)

sanic PYPI version 22.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - fpx =0.4.0, =0.4.2, =0.4.0, =2.2.0, =3.4.5.dev8, =3.4.10.dev2 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

Candidate Comparability Before Promotion: Conditional Validation in Adaptive Network Intrusion Detection

Adaptive network intrusion detection systems retrain classifiers after drift alarms, but an alarm detects change; it does not establish that a challenger should replace the deployed incumbent. Promotion is security-relevant because it changes the model responsible for subsequent attack detection,...

monerochan-stark (>=5.2.2, <=5.2.12), p3-circle (>=0.1.0, <=0.4.3-succinct) +30 more potentially affected by CVE-2026-46654 via p3-challenger (>=0.1.0, <=0.4.3-succinct)

p3-challenger CARGO version =0.1.0, =5.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.5-succinct, =0.1.0, =0.1.0, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.9.0 and more Source cves: CVE-2026-46654 Source advisory: OSV:GHSA-VJ64-RJF3-W3V7...

GHSA-VJ64-RJF3-W3V7 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Impact - Key: challenger/src/multifieldchallenger.rs | MultiField32Challenger::duplexing | transcriptmalleability - Affected files: challenger/src/multifieldchallenger.rs, field/src/helpers.rs - Violated invariant: The Fiat-Shamir sponge must bind challenges to the exact sequence of observed fiel...

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Impact - Key: challenger/src/multifieldchallenger.rs | MultiField32Challenger::duplexing | transcriptmalleability - Affected files: challenger/src/multifieldchallenger.rs, field/src/helpers.rs - Violated invariant: The Fiat-Shamir sponge must bind challenges to the exact sequence of observed fiel...

monerochan-stark (>=5.2.2, <=5.2.12), p3-circle (>=0.1.0, <=0.4.3-succinct) +30 more potentially affected by CVE-2026-46654 via p3-challenger (>=0.1.0, <=0.4.3-succinct)

p3-challenger CARGO version =0.1.0, =5.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.5-succinct, =0.1.0, =0.1.0, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.9.0 and more Source cves: CVE-2026-46654 Source advisory: GHSA-VJ64-RJF3-W3V7...

CVE-2019-12167

httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter...

EUVD-2019-3816

Malware in sbrugna...

challenger.com Cross Site Scripting vulnerability OBB-3926760

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Challenger can change the output root or delete output root arbitrarily to authorize invalid withdrawal or block withdrawal infinitely

Lines of code Vulnerability details Impact Challenger can change the output root or delete output root arbitrarily Proof of Concept In the OptimismPortal.sol, when prove and finalize the transaction the output root needs to be verificated // Grab the OutputProposal from the L2OutputOracle, will...

The owner of position can mint zchf unlimitedly by becoming the challenger that successfully challenges their own position to receive unlimit reward.

Lines of code Vulnerability details Summary The owner of position can become the challenger of his position and end the challenge within the same block after the open the position to earn unlimited reward. By executing within the same block, the owner could prevent the intervention of other...

Challenger incentives can be inflated with external transfers

Lines of code Vulnerability details Impact The function notifyChallengeSucceeded calculates the volume of ZCHF to be repaid, which is then used to calculate the reward for the challenger. The challenger can however artificially inflate this value. A challenger can start a challenge on an...

Attacker can extract unlimited ZCHF by setting a high price for a position and challenging it

Lines of code Vulnerability details An attacker can act as both minter and challenger, and profit by setting an arbitrarily high price for a position way higher than what the collateral really is worth, and then immediately challenging the position. After the challenge succeeds, the attacker will...

CVE-2019-12167

httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter...

CVE-2019-12167

httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter...

Design/Logic Flaw

httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter...

CVE-2019-12167

httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter...

CVE-2019-12167

The CVE-2019-12167 entry affects Emerson Network Power Liebert Challenger 5.1E0.5 devices. The vulnerability exists in httpGetSet/httpGet.htm via the statusstr parameter, enabling Cross Site Scripting (XSS). Reported impact is that a remote attacker can inject scripts into a request and have the ...

CVE-2019-12167: Improper Neutralization of Input During Web Page Generation

httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter...