Common Vulnerabilities and Exposures (CVE) is a database of known vulnerabilities.

learn more… | top users | synonyms

0
votes
1answer
37 views

Where can I find real life examples of software vulnerabilities in OSS?

I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly ...
-3
votes
1answer
79 views

Vulnerabilities for CVE

Can any vulnerability be assigned a CVE number? For vulnerabilities like this: http://seclists.org/fulldisclosure/2016/Apr/92 Can it be assigned a CVE number? (seems it does not have a CVE id now) ...
1
vote
0answers
55 views

Compilations of PoC of JavaScript vulnerabilities?

I am a researcher looking for some proof-of-concept JavaScript vulnerabilities like XSS that exists in some website or JavaScript libraries in the past. Are there any compilations of them?
2
votes
1answer
38 views

CVEs aggregated by programming language?

Is there a way to search the CVE database by programming language? For instance, I'd consider CVE-2015-4852 to be a Java-specific vulnerability as the scope of the vulnerability is the commons-...
5
votes
0answers
40 views

How could I train a ML system to identify vulnerabilities in code? [closed]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...
6
votes
3answers
110 views

How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?

This is a hypothetical question. The answers would help me to learn how CVE issues CVE IDs to vulnerabilities. Let us assume that I have followed the principles of responsible disclosure, reported ...
2
votes
0answers
35 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
7
votes
1answer
342 views

How can CVE-2016-2324 and -2315 be mitigated on Mac OS X?

The recent git remote execution vulnerability states all git clients with version <2.7.1 are vulnerable and that most linux distributions have included the fixes already. However, as of today, $...
7
votes
3answers
317 views

How to compile java_atomicreferencearray (CVE-2012-0507) exploit to run calc.exe on system?

I got interested in java exploits and stumbled upon this: https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen It is source code for Java exploit, so even though my knowledge of ...
1
vote
1answer
115 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
5
votes
3answers
716 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
3
votes
1answer
316 views

OpenSSH < 7.0 Multiple vulnerabilities question

Nessus reports this as Critical however there are issues such as 'CVE-2015-5600' that CVE is 8.5 but Red Hat reports it as a 'Low' issue. https://access.redhat.com/security/cve/CVE-2015-5600 Reports ...
3
votes
1answer
185 views

Is there any information on the impact of CVE-2016-1907 (openSSH)?

I just saw the notification about CVE-2016-1907 this morning: The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-...
0
votes
1answer
83 views

Can CVEs (or any vulnerability) be dependent on one another?

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same ...
0
votes
2answers
92 views

How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year? [duplicate]

The last time such a question was asked, there weren't even an official solution. Now we are supposedly on 5 digit CVE numbers for a whole year now, I've never seen then in the wild (apart from on ...
16
votes
3answers
498 views

Would CVE-2016-0728 affect Docker?

I ended up having a discussion about Docker and system security today and we came to the point where we asked ourselves of the latest CVE-2016-0728 exploit (privilege escalation) would affect Docker ...
9
votes
1answer
5k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
7
votes
1answer
228 views

How to exactly create a CVE? [duplicate]

I found an heap overflow exploit for a vulnerability in git servers. This lead to lucrative operations on various bug bounty programs (GitHub already promised to put me in their top 10). When it ...
2
votes
1answer
106 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
5
votes
1answer
429 views

What are the mitigating factors for CVE-2015-5364?

CVE-2015-5364 describes a UDP based DoS vulnerability in the Linux kernel that can be used to deny processing cycles to the host operating system and its applications. https://access.redhat.com/...
19
votes
1answer
1k views

What to do after you get a CVE?

I recently reported a security vulnerability and it was patched. The patch (and associated issue) are both out in the open in a Github repo (aka public). I contacted cve-assign@mitre.org to get a CVE ...
1
vote
1answer
97 views

How is a exploit code mmaped in user space executed in kernel space?

I am reading about a Ubuntu-12.10 security exploit CVE-2013-1763 which describes the vulnerability of stack buffer overflow that can be exploited to escalate privilege of a process and gain root ...
2
votes
2answers
76 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
0
votes
0answers
112 views

How do Common Vulnerabilities and Exposures (CVEs) work?

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages. I am looking for a ...
-1
votes
1answer
57 views

Can someone teach or explain to me this CVE?

The CVE number is 2012-2089. I don't really understand what this summary of cve meant. Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1....
5
votes
2answers
287 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
1
vote
2answers
546 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
1
vote
2answers
336 views

In the context of a CVE, what does “unspecified vectors” mean?

Let's take this CVE for example: http://www.cvedetails.com/cve/CVE-2014-9283/ obtain administrative access via unspecified vectors. What unspecified vectors means ? I saw this term in a a lot ...
5
votes
1answer
495 views

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's ...
3
votes
2answers
2k views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
9
votes
4answers
12k views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
2
votes
1answer
368 views

Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat? [closed]

I'm looking for a RSS feed or a mailing list that would allow me to be alerted of new CVEs impacting Windows or Red Hat that have a very high score, such as the recent ones for Shellshock and Winshock ...
-1
votes
1answer
202 views

RSS Feed Security warnings [closed]

I am looking for an service to get Security Warnings (CVE) for PHP, Apache and different Frameworks. Does someone know an source where i am able to get those as RSS Feed?
7
votes
1answer
545 views

Why do some known vulnerabilities have no CVE ID?

Why do some known vulnerabilities have no CVE ID? And why does some vulnerability have a CVE ID assigned but no information on cve.mitre.org or cvedetail.com?
3
votes
1answer
186 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
-1
votes
2answers
262 views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
2
votes
1answer
422 views

Why is the code CVE-2010-5298 used for a vulnerability discovered in 2014?

I was looking through the OpenSSL vulnerabilities list and came across CVE-2010-5298 as a 2014 vulnerability. At http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298, under Date Entry Created,...
4
votes
4answers
255 views

When to apply for a CVE?

When you find a vulnerability, do you contact CVE assigners before contacting the vendor or after the vendor has fixed the problem? PS: do not link to How are CVE identifiers assigned and managed?, ...
3
votes
2answers
468 views

How dangerous is the security hole CVE-2014-019?

There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges How ...
4
votes
2answers
205 views

What to do if a vendor does not assign a CVE for an acknowledge vulnerability?

We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas). We notified the company, they ...
27
votes
3answers
2k views

Why did Java (JRE) vulnerabilities peak in 2012-2013?

I've taken a graph of the amount of CVE reports concerning the JRE per Year. Now as you can see this spiked in 2012-2013, which could have been guessed easily, if you look at the amount of news items ...
2
votes
1answer
675 views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
1
vote
0answers
188 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
0answers
81 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
1answer
194 views

Starting out, where should I be looking for vulns? Big bounty sites vs. smaller projects? [closed]

I'm an amateur web application security enthusiast with what I would say is an intermediate level of knowledge at this point. I'm interested in finding full time work as a web app pen tester. Up ...
2
votes
1answer
71 views

What does the field vuln-security-protection stand-for in the NVD cve lists 2.0?

In the different NVD files which enumerates the CVE, which can be found here There is from time to time the field <vuln:security-protection> , containing often the value ALLOWS_OTHER_ACCESS or ...
2
votes
1answer
74 views

How to calculate CVSS of an attack so that it matches those in CVEs?

I have drawn an attack graph for a file-sharing application (eg. Dropbox) where a database stores details of virtual machines Eg. memory space left, etc. I've listed some possible attacks: The ...
1
vote
1answer
30 views

Is there an other place than the changelogs to see if a debian package is corrected or not?

I would like to know if there was an other place to see if a debian package is fixing a CVE than the changelog of the packet. For instance the packet bind9 1:9.7.2.dfsg.P3-1 is fixing the CVE-2010-...
1
vote
2answers
120 views

How can we know which debian package correct which CVE

We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance : ...
1
vote
2answers
4k views

Automatically search Metasploit for useable exploits based on vulnerabilties in the database

Is it possible to automatically search the Metasploit database for usable exploits based on information about the vulnerabilities on the hosts? Searching in Metasploit for each CVE number to see if ...