A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

15
votes
7answers
3k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
4
votes
4answers
113 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
12
votes
4answers
612 views

I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?

I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities. Rails has their own policy ...
0
votes
1answer
37 views

Where can I find real life examples of software vulnerabilities in OSS?

I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly ...
0
votes
1answer
102 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
3
votes
1answer
109 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
4
votes
1answer
167 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
1
vote
2answers
145 views

Is there other vulnerabilities than CVE of NVD

I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs? Thx
6
votes
2answers
1k views

How are CVE identifiers assigned and managed?

CVE Identifiers (a.k.a. CVE IDs) are used to uniquely identifier a particular vulnerability. We've all seen them on various bulletins, and they're useful when researching an issue. But how are they ...
1
vote
1answer
109 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
4
votes
2answers
94 views

Why does SSL Labs say that POODLE is mitigated if a server chooses RC4?

I always thought that if a server supports SSLv3 and CBC ciphers, then it is vulnerable to POODLE. But it looks like that is not the case. For example, for Google.com, SSL Labs says that the SSL ...
5
votes
2answers
99 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
3
votes
1answer
54 views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
4
votes
2answers
84 views

Software Library Vulnerability Tracking

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities. Is anyone aware of any comprehensive data sources aside ...
7
votes
2answers
57 views

Are any inherently insecure AES-CBC keys or key-IV combos known for properly generated random values?

This is mostly a theoretical question. I am using AES128 CBC to encrypt small files. Both my keys and my IVs are randomly generated per file using iOS's secure random value generation (...
5
votes
0answers
788 views

How to protect from ROM-0 via port triggering?

I'm using an anti-virus that told me that my router can be compromised with the ROM-0 vulnerability. It told me to use "port forwarding" to fix it. But, my router have a "port triggering", which they ...
2
votes
3answers
73 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
-2
votes
1answer
50 views

Threats for video files [closed]

I'm trying to figure out what are the known vulnerabilities in video file formats? And, if by any chance, anyone knows about an application to scan or whitelist these files from any harmful ...
2
votes
3answers
109 views

Where to find about web application vulnerabilities' history? [closed]

There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, ...
18
votes
3answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
46
votes
3answers
38k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
17
votes
2answers
5k views

How exploitable is the recent UseRoaming SSH problem?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
12
votes
4answers
7k views

OpenBSD vs. NetBSD security

If I search for the two words: OpenBSD and NetBSD on http://www.exploit-db.com/ then I get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD. So what are the ...
32
votes
10answers
7k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
2
votes
1answer
66 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android app,...
5
votes
2answers
255 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the "...
0
votes
1answer
749 views

POODLE vulnerability solution : Effect on customer or client side

I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...
1
vote
0answers
64 views

How to react to the glibc vulnerability as an OSX user? [duplicate]

Apologies if this question isn't really fit for this SE site. Wasn't sure whether to post it here, or on apple.SE. What's the currently best way for a user of OSX to react to: https://...
0
votes
1answer
169 views

Can the latest glibc DNS vuln be tested on remote servers?

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely ...
0
votes
1answer
531 views

GNU C Library getaddrinfo() Flaw

As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow ...
0
votes
2answers
49 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
3
votes
1answer
4k views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
0
votes
1answer
83 views

Can CVEs (or any vulnerability) be dependent on one another?

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same ...
1
vote
0answers
131 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
2
votes
3answers
5k views

Help configuring Cisco router

I have some network issues in my network due to misconfiguration of Cisco router and switches. Please give me some advice or solutions to fix these vulnerabilities and configuration issues. ...
11
votes
3answers
847 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
1
vote
1answer
60 views

How to patch haproxy for OpenSSL vulnerability USN-2830-1

This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on ...
1
vote
1answer
40 views

Reliable Sources for Software Vulnerability Patch Release dates

I have searched in NVD and realized that patch release dates are not published with the specific vulnerability information of an application. Other information like the "update date" do not ...
0
votes
0answers
32 views

Is there a way to link STIGs to CCEs?

A federal customer sent us a list of vulnerabilities for one of our RHEL6 systems that was generated by the Security Content Automation Protocol (SCAP) Compliance Checker (SSC). The findings are ...
1
vote
0answers
76 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
6
votes
3answers
5k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
0
votes
0answers
69 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
5
votes
2answers
597 views

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like: # vim: set someoption=somevalue and will then set those options. This is awesome if I'...
3
votes
3answers
54 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
2
votes
2answers
2k views

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

I am no expert in this area but after some searching I am not too sure about the solution. An external vendor doing a pentration test on our server reported that we have ...
7
votes
3answers
1k views

How to hack a Win95 machine?

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither ...
1
vote
2answers
34 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
1answer
99 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
13
votes
2answers
17k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...