A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

3
votes
1answer
45 views

Are there open databases or sites similar to xssed.com, not necessarily about XSS?

Are there open databases, websites similar to xssed.com that are not necessarily about XSS, but where people report SQL inject-able websites or malware infected websites, for example? Potentially ...
3
votes
2answers
77 views

How can I convey risks associated with out-of-support software?

Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS....
4
votes
4answers
120 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
3
votes
1answer
113 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
0
votes
1answer
48 views

Where can I find real life examples of software vulnerabilities in OSS?

I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly ...
4
votes
2answers
103 views

Why does SSL Labs say that POODLE is mitigated if a server chooses RC4?

I always thought that if a server supports SSLv3 and CBC ciphers, then it is vulnerable to POODLE. But it looks like that is not the case. For example, for Google.com, SSL Labs says that the SSL ...
5
votes
2answers
101 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
3
votes
1answer
64 views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
2
votes
2answers
140 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
4
votes
2answers
90 views

Software Library Vulnerability Tracking

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities. Is anyone aware of any comprehensive data sources aside ...
5
votes
1answer
213 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
2
votes
3answers
75 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
-2
votes
1answer
52 views

Threats for video files [closed]

I'm trying to figure out what are the known vulnerabilities in video file formats? And, if by any chance, anyone knows about an application to scan or whitelist these files from any harmful ...
2
votes
3answers
112 views

Where to find about web application vulnerabilities' history? [closed]

There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, ...
1
vote
1answer
132 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
7
votes
2answers
60 views

Are any inherently insecure AES-CBC keys or key-IV combos known for properly generated random values?

This is mostly a theoretical question. I am using AES128 CBC to encrypt small files. Both my keys and my IVs are randomly generated per file using iOS's secure random value generation (...
12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
2
votes
1answer
66 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android app,...
1
vote
0answers
64 views

How to react to the glibc vulnerability as an OSX user? [duplicate]

Apologies if this question isn't really fit for this SE site. Wasn't sure whether to post it here, or on apple.SE. What's the currently best way for a user of OSX to react to: https://...
0
votes
1answer
169 views

Can the latest glibc DNS vuln be tested on remote servers?

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely ...
0
votes
1answer
540 views

GNU C Library getaddrinfo() Flaw

As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow ...
0
votes
2answers
49 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
0
votes
1answer
84 views

Can CVEs (or any vulnerability) be dependent on one another?

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same ...
1
vote
0answers
150 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
17
votes
2answers
6k views

How exploitable is the recent UseRoaming SSH problem?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
11
votes
3answers
857 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
1
vote
1answer
64 views

How to patch haproxy for OpenSSL vulnerability USN-2830-1

This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on ...
0
votes
0answers
33 views

Is there a way to link STIGs to CCEs?

A federal customer sent us a list of vulnerabilities for one of our RHEL6 systems that was generated by the Security Content Automation Protocol (SCAP) Compliance Checker (SSC). The findings are ...
7
votes
3answers
7k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
0
votes
0answers
75 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
5
votes
0answers
835 views

How to protect from ROM-0 via port triggering?

I'm using an anti-virus that told me that my router can be compromised with the ROM-0 vulnerability. It told me to use "port forwarding" to fix it. But, my router have a "port triggering", which they ...
1
vote
0answers
77 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
5
votes
2answers
281 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the "...
4
votes
2answers
3k views

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

I am no expert in this area but after some searching I am not too sure about the solution. An external vendor doing a pentration test on our server reported that we have ...
3
votes
3answers
56 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
1
vote
2answers
35 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
1answer
99 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
1
vote
1answer
42 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
1
vote
1answer
40 views

Reliable Sources for Software Vulnerability Patch Release dates

I have searched in NVD and realized that patch release dates are not published with the specific vulnerability information of an application. Other information like the "update date" do not ...
2
votes
1answer
116 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
0
votes
2answers
206 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new MemoryStream(...
0
votes
2answers
505 views

What current algorithms are considered (un)secure? [closed]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
2
votes
0answers
90 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (...
3
votes
1answer
608 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
3
votes
2answers
124 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
0
votes
0answers
115 views

How do Common Vulnerabilities and Exposures (CVEs) work?

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages. I am looking for a ...
0
votes
1answer
172 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
3
votes
1answer
4k views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
2
votes
1answer
66 views

Is auto-redirecting to another site a secure defense against POODLE?

Normally, servers that support SSL 3.0 are vulnerable to the POODLE attack. But, consider a server that has the following interesting combination of features: It supports SSL 3.0. If you connect to ...
0
votes
5answers
67 views

Where can I find a description list for major vulnerabilities? [closed]

I'm looking for a description list for major vulnerabilities such as SQLi, XSS etc. The format should be like this: Short Description: Description: Impact: Solution/How to prevent: ...