The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
1answer
22 views

CVEs aggregated by programming language?

Is there a way to search the CVE database by programming language? For instance, I'd consider CVE-2015-4852 to be a Java-specific vulnerability as the scope of the vulnerability is the ...
5
votes
0answers
36 views

How could I train a ML system to identify vulnerabilities in code? [on hold]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...
6
votes
3answers
66 views

How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?

This is a hypothetical question. The answers would help me to learn how CVE issues CVE IDs to vulnerabilities. Let us assume that I have followed the principles of responsible disclosure, reported ...
2
votes
0answers
27 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
6
votes
1answer
284 views

How can CVE-2016-2324 and -2315 be mitigated on Mac OS X?

The recent git remote execution vulnerability states all git clients with version <2.7.1 are vulnerable and that most linux distributions have included the fixes already. However, as of today, ...
5
votes
2answers
203 views

How to compile java_atomicreferencearray (CVE-2012-0507) exploit to run calc.exe on system?

I got interested in java exploits and stumbled upon this: https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen It is source code for Java exploit, so even though my knowledge of ...
1
vote
0answers
63 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
4
votes
3answers
674 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
3
votes
1answer
145 views

OpenSSH < 7.0 Multiple vulnerabilities question

Nessus reports this as Critical however there are issues such as 'CVE-2015-5600' that CVE is 8.5 but Red Hat reports it as a 'Low' issue. https://access.redhat.com/security/cve/CVE-2015-5600 Reports ...
3
votes
1answer
149 views

Is there any information on the impact of CVE-2016-1907 (openSSH)?

I just saw the notification about CVE-2016-1907 this morning: The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service ...
0
votes
1answer
78 views

Can CVEs (or any vulnerability) be dependent on one another?

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same ...
0
votes
2answers
85 views

How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year? [duplicate]

The last time such a question was asked, there weren't even an official solution. Now we are supposedly on 5 digit CVE numbers for a whole year now, I've never seen then in the wild (apart from on ...
16
votes
3answers
420 views

Would CVE-2016-0728 affect Docker?

I ended up having a discussion about Docker and system security today and we came to the point where we asked ourselves of the latest CVE-2016-0728 exploit (privilege escalation) would affect Docker ...
9
votes
1answer
5k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
7
votes
1answer
184 views

How to exactly create a CVE? [duplicate]

I found an heap overflow exploit for a vulnerability in git servers. This lead to lucrative operations on various bug bounty programs (GitHub already promised to put me in their top 10). When it ...
2
votes
1answer
86 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
5
votes
1answer
407 views

What are the mitigating factors for CVE-2015-5364?

CVE-2015-5364 describes a UDP based DoS vulnerability in the Linux kernel that can be used to deny processing cycles to the host operating system and its applications. ...
18
votes
1answer
1k views

What to do after you get a CVE?

I recently reported a security vulnerability and it was patched. The patch (and associated issue) are both out in the open in a Github repo (aka public). I contacted cve-assign@mitre.org to get a CVE ...
1
vote
1answer
90 views

How is a exploit code mmaped in user space executed in kernel space?

I am reading about a Ubuntu-12.10 security exploit CVE-2013-1763 which describes the vulnerability of stack buffer overflow that can be exploited to escalate privilege of a process and gain root ...
2
votes
2answers
73 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
0
votes
0answers
101 views

How do Common Vulnerabilities and Exposures (CVEs) work?

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages. I am looking for a ...
-1
votes
1answer
51 views

Can someone teach or explain to me this CVE?

The CVE number is 2012-2089. I don't really understand what this summary of cve meant. Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and ...
5
votes
2answers
276 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
1
vote
2answers
508 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
1
vote
1answer
293 views

In the context of a CVE, what does “unspecified vectors” mean?

Let's take this CVE for example: http://www.cvedetails.com/cve/CVE-2014-9283/ obtain administrative access via unspecified vectors. What unspecified vectors means ? I saw this term in a a lot ...
1
vote
0answers
497 views

How to exploit CVE-2014-5203? [closed]

There is a vulnerability in WordPress 3.9 that allows an attacker to execute arbitrary PHP code (remote code execution) and the details about the same are covered in CVE-2014-5203: ...
4
votes
1answer
443 views

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's ...
3
votes
2answers
2k views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
8
votes
4answers
10k views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
2
votes
1answer
298 views

Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat? [closed]

I'm looking for a RSS feed or a mailing list that would allow me to be alerted of new CVEs impacting Windows or Red Hat that have a very high score, such as the recent ones for Shellshock and Winshock ...
-1
votes
1answer
192 views

RSS Feed Security warnings [closed]

I am looking for an service to get Security Warnings (CVE) for PHP, Apache and different Frameworks. Does someone know an source where i am able to get those as RSS Feed?
7
votes
1answer
513 views

Why do some known vulnerabilities have no CVE ID?

Why do some known vulnerabilities have no CVE ID? And why does some vulnerability have a CVE ID assigned but no information on cve.mitre.org or cvedetail.com?
3
votes
1answer
179 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
-1
votes
2answers
231 views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
2
votes
1answer
402 views

Why is the code CVE-2010-5298 used for a vulnerability discovered in 2014?

I was looking through the OpenSSL vulnerabilities list and came across CVE-2010-5298 as a 2014 vulnerability. At http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298, under Date Entry ...
4
votes
3answers
213 views

When to apply for a CVE?

When you find a vulnerability, do you contact CVE assigners before contacting the vendor or after the vendor has fixed the problem? PS: do not link to How are CVE identifiers assigned and managed?, ...
3
votes
2answers
460 views

How dangerous is the security hole CVE-2014-019?

There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges How ...
4
votes
1answer
183 views

What to do if a vendor does not assign a CVE for an acknowledge vulnerability?

We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas). We notified the company, they ...
27
votes
3answers
2k views

Why did Java (JRE) vulnerabilities peak in 2012-2013?

I've taken a graph of the amount of CVE reports concerning the JRE per Year. Now as you can see this spiked in 2012-2013, which could have been guessed easily, if you look at the amount of news items ...
2
votes
1answer
609 views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
1
vote
0answers
177 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
0answers
80 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
1answer
192 views

Starting out, where should I be looking for vulns? Big bounty sites vs. smaller projects? [closed]

I'm an amateur web application security enthusiast with what I would say is an intermediate level of knowledge at this point. I'm interested in finding full time work as a web app pen tester. Up ...
2
votes
1answer
65 views

What does the field vuln-security-protection stand-for in the NVD cve lists 2.0?

In the different NVD files which enumerates the CVE, which can be found here There is from time to time the field <vuln:security-protection> , containing often the value ALLOWS_OTHER_ACCESS or ...
2
votes
1answer
72 views

How to calculate CVSS of an attack so that it matches those in CVEs?

I have drawn an attack graph for a file-sharing application (eg. Dropbox) where a database stores details of virtual machines Eg. memory space left, etc. I've listed some possible attacks: The ...
1
vote
1answer
28 views

Is there an other place than the changelogs to see if a debian package is corrected or not?

I would like to know if there was an other place to see if a debian package is fixing a CVE than the changelog of the packet. For instance the packet bind9 1:9.7.2.dfsg.P3-1 is fixing the ...
1
vote
2answers
116 views

How can we know which debian package correct which CVE

We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance : ...
1
vote
2answers
4k views

Automatically search Metasploit for useable exploits based on vulnerabilties in the database

Is it possible to automatically search the Metasploit database for usable exploits based on information about the vulnerabilities on the hosts? Searching in Metasploit for each CVE number to see if ...
1
vote
1answer
130 views

Is there other vulnerabilities than CVE of NVD

I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs? Thx
3
votes
1answer
4k views

Resources for determining if Metasploit has exploit for given CVE

Are there any reliable resources for finding whether or not a Metasploit exploit exists for a given CVE? I have found CVE Details to be woefully out of date with regards to keeping this information ...