A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

4
votes
2answers
2k views

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

I am no expert in this area but after some searching I am not too sure about the solution. An external vendor doing a pentration test on our server reported that we have ...
7
votes
3answers
1k views

How to hack a Win95 machine?

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither ...
1
vote
2answers
35 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
1answer
99 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
13
votes
2answers
18k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
1
vote
1answer
42 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
15
votes
4answers
15k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
46
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
2
votes
1answer
116 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
0
votes
2answers
206 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new MemoryStream(...
27
votes
7answers
530 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
18
votes
6answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
0
votes
2answers
503 views

What current algorithms are considered (un)secure? [closed]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
3
votes
2answers
5k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-...
2
votes
0answers
90 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (...
3
votes
1answer
606 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
3
votes
2answers
124 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
10
votes
1answer
5k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
2
votes
3answers
128 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
2answers
155 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...
4
votes
4answers
11k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
0
votes
0answers
114 views

How do Common Vulnerabilities and Exposures (CVEs) work?

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages. I am looking for a ...
0
votes
1answer
172 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
2
votes
1answer
66 views

Is auto-redirecting to another site a secure defense against POODLE?

Normally, servers that support SSL 3.0 are vulnerable to the POODLE attack. But, consider a server that has the following interesting combination of features: It supports SSL 3.0. If you connect to ...
13
votes
2answers
784 views

How to make a website patch their poor security?

I am following an online class from a local institution. Recently, I've noticed they don't hash passwords because they sent me my password by e-mail in clear text. The website has a lot of personal ...
0
votes
5answers
67 views

Where can I find a description list for major vulnerabilities? [closed]

I'm looking for a description list for major vulnerabilities such as SQLi, XSS etc. The format should be like this: Short Description: Description: Impact: Solution/How to prevent: ...
0
votes
0answers
243 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
6
votes
1answer
302 views

Does mutual SSL authentication increases protection against a Poodle attack?

Recently we found our self pondering whether a certificate based mutual SSL authentication protects against a Poodle attack over SSLv3? We’re stuck in a situation where a client-application only ...
3
votes
2answers
6k views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
1
vote
1answer
351 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
2
votes
1answer
75 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
1
vote
1answer
136 views

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)? From Mark's answer on ...
3
votes
1answer
439 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
1
vote
2answers
560 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
5
votes
1answer
3k views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
1
vote
2answers
360 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
2
votes
2answers
691 views

List of most common network vulnerabilities a la OWASP Top 10 [closed]

I am trying to find the most commonly used attack vectors/techniques on computer networks in the style of the owasp top 10, for my thesis work. The reports shouldn't be older than 2-3 years. Can you ...
3
votes
7answers
839 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
5
votes
2answers
866 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
33
votes
5answers
6k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
2
votes
0answers
103 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
8
votes
3answers
11k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
2
votes
2answers
19k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 (...
4
votes
2answers
298 views

Fuzzing and its impact on testing environment

I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests. I'm ...
5
votes
3answers
1k views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
22
votes
9answers
5k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
8
votes
1answer
988 views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
7
votes
2answers
809 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
3
votes
2answers
2k views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
1
vote
0answers
93 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...