61 matches found
CVE-2024-12034
The CVE-2024-12034 entry concerns the Advanced Google reCAPTCHA plugin for WordPress, where an insufficiently random/unsecure key used to generate unblock requests allows unauthenticated attackers to unblock their IP after a lockout. Affected versions include all up to 1.25. The issue has a publi...
PT-2024-17413 · WordPress · Advanced Google Recaptcha Plugin
Name of the Vulnerable Software and Affected Versions: Advanced Google reCAPTCHA plugin for WordPress versions up to 1.25 Description: The issue arises because the plugin does not utilize a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers ...
Malicious code in GoogleReCaptcha.V4 (NuGet)
--- -= Per source details. Do not edit below this line.=-...
CVE-2023-48654
One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the...
One Identity Password Manager Kiosk Escape Privilege Escalation
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Kiosk Escape Privilege Escalation product: One Identity Password Manager Secure Password Extension vulnerable version: 5.13.1 fixed version: 5.13.1 CVE number:...
Voicemail Scam Steals Microsoft Credentials
Attackers are using an oft-used and still effective lure to steal credentials to key Microsoft apps by sending emails notifying potential victims that they have a voicemail message, researchers have found. A team from Zscaler ThreatLabZ has been monitoring a campaign since May that targets key...
YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue PoC As author, put the following payload in the Settings Integration Use Google reCaptcha Yes Site Key: v v 6.3.5 - "...
YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue As author, put the following payload in the Settings Integration Use Google reCaptcha Yes Site Key: v v 6.3.5 - "...
Threat actors using CAPTCHA to evade phishing, malware detection
By Waqas According to researchers, cybercriminals are abusing legitimate challenge and response services like Google’s reCAPTCHA or deploying customized fake CAPTCHA-like validation. This is a post from HackRead.com Read the original post: Threat actors using CAPTCHA to evade phishing, malware...
CVE-2021-24189 Captchinoo, Google recaptcha for admin login page < 2.4 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then...
WordPress Captchinoo, Google recaptcha for admin login page plugin <= 2.3 - Arbitrary Plugin Installation and Activation vulnerability
Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress Captchinoo, Google recaptcha for admin login page plugin versions = 2.3. Solution This plugin has been closed as of March 23, 2021 and is not available for download. This closure is temporary, pending a...
Fake Google reCAPTCHA Phishing Attack Swipes Office 365 Passwords
Microsoft users are being targeted with thousands of phishing emails, in an ongoing attack aiming to steal their Office 365 credentials. The attackers add an air of legitimacy to the campaign by leveraging a fake Google reCAPTCHA system and top-level domain landing pages that include the logos of...
Cross-Site Scripting in extension "Google reCAPTCHA (v2/v3)" (jh_captcha)
The extension fails to properly encode user input for output in HTML context. The issue is only exploitable by backend users with access to TypoScript settings of the extension...
Razer: Expired reCAPTCHA site key leads to Rate Limit Bypass and Email Enumeration
The tester discovered a configuration issue involving Google reCAPTCHA that would allow adversaries to enumerate valid email addresses for users. While minor, Razer appreciates the report and clear PoC...
Android banking malware distributed with fake Google reCAPTCHA
By Waqas Sucuri’s cybersecurity researchers have identified a highly sophisticated phishing campaign that is specifically targeting online banking users. The attack, for now, has been directed against a Polish bank in which attackers are exploiting Google reCAPTCHA systems as well as...
unCAPTCHA AI Cracks Google reCAPTCHAs with 90% Accuracy
unCAPTCHA, an artificial intelligence-based automated system designed at the University of Maryland, has been updated to break Google’s latest audio-based reCAPTCHA challenges with an accuracy rate of 90 percent. Google has been working on refining and strengthening reCAPTCHA for years, a Turing...
Weblate: Bypassing captcha in registration on Hosted site
Hello again, I believe the captcha on the user registration form is very simple and can be easily bypassed to automatically register any number of accounts. A program can read the math captcha, solve it and submit the form with the answer and the other required parameters & headers. Note: I read...
Google Captcha <= 1.12 - Authentication Bypass
The reCaptcha by BestWebSoft WordPress plugin was affected by an Authentication Bypass security vulnerability...
Google's reCAPTCHA can tell if You're a Spambot or Human with Just a Click
Many a time we deal with those strange words and phrases that ask us to type them back in plaintext while signing up for an account. Yes, those increasingly annoying CAPTCHAs !!, which are both time-consuming and sometimes very difficult to read. If you really are tired of these distorted series ...