Threats Tagged 'cwe-804'

HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.

WWBN AVideo versions 29.0 and earlier contain a vulnerability in the CAPTCHA implementation where the CAPTCHA length can be set by an unauthenticated client without validation, allowing generation of a 1-character CAPTCHA. Because the CAPTCHA comparison is case-insensitive over a limited alphabet and failed attempts do not consume the session token, an attacker can brute-force the CAPTCHA in about 33 attempts per session. This affects any endpoint relying on Captcha::validation(), such as user registration and password recovery. A fix is available in commit bf1c76989e6a9054be4f0eb009d68f0f2464b453, but no official vendor advisory or patch release is referenced.

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.

CriticalVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-40916#cwe-338

The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.

Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7.

Guessable CAPTCHA vulnerability in BestWebSoft Captcha by BestWebSoft allows Functionality Bypass.This issue affects Captcha by BestWebSoft: from n/a through 5.2.0.