A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.
2
votes
2answers
302 views
Is it a weakness to be able to see server side scripting?
Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction.
CLARIFICATION: ...
6
votes
4answers
314 views
Worst case scenario of having the ability to remotely write files to disk as admin
I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
4
votes
3answers
311 views
VGA/HDMI Based Attack
Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side?
How about HDMI or DVI?
And if so, are there known malware or PoCs to do that? or is it theoretically ...
0
votes
1answer
231 views
apache mod_isapi public exploits
In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll.
I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
1
vote
1answer
285 views
Apache mod_rewrite vulnerability
The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
13
votes
3answers
250 views
Risks of Mullions in High Security Areas
I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
1
vote
1answer
3k views
known public exploits for vsftpd 2.0.1/2.0.5
I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits.
The server I am working on has vsftpd 2.0.5 ...
2
votes
2answers
111 views
Any solution to passing a penetration test for an outdated php web application without upgrading the application?
A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
4
votes
3answers
649 views
How can I report PCI-DSS violations?
A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
1
vote
2answers
200 views
Microsoft SQL server 2000 sp3a - isn't it oudated?
I just noticed that many servers use Microsoft SQL server 2000. But isn't 2000 outdated by 2003? Why are people still using 2000? Would there be any serious security vulnerability by using Microsoft ...
2
votes
2answers
308 views
Vulnerability of a computer behind a serial port?
Let’s consider these 4 computers :
East Coast location :
computer East1 is connected to the internet.
computer East2 is connected to East1 through a RS232 serial cable.
West Coast location :
...
2
votes
1answer
194 views
How does malware such as Stuxnet and Flamer propagate through USB memory sticks?
The best explanation I found is from this article but it still is unclear to me. Apparently a new vulnerability has been found involving .lnk files where when a folder on the memory stick containing ...
2
votes
2answers
519 views
Interesting article on a vulnerability found in Tor
This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out ...
0
votes
1answer
455 views
Is this Ubuntu server configuration secure?
I'm new to Linux and security matters. I have a vps with Ubuntu 12.04 server and I wonder how secure this server is.
I set up ssh passwordless login and disabled ssh login for root. I update security ...
2
votes
3answers
829 views
Open Source Vulnerability Scanner
I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
1answer
84 views
Types of attacks outside of AppSec and Vendor-Specific Systems?
I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
2
votes
2answers
63 views
Does the CVSS impact score correpond to probability?
From http://nvd.nist.gov/cvsseq2.htm , I noticed that the CVSS standard attributes the following impact values for confidentiality, integrity and availability: 0 for none impact , 0.275 for partial ...
0
votes
2answers
79 views
Looking for information about CVE-2006-6876 vulnerability
In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server.
But I ...
0
votes
0answers
35 views
more justification for the impact scores used by the national vulnerability database [duplicate]
Possible Duplicate:
why CVSS give a score of 0.66 for a full impact on CIA?
Good day ;
the CVSS attributes the following impact values for confidentiality, integrity and availability:
...
0
votes
1answer
99 views
How can I remotely detect versions? [closed]
I want to know how to remotely detect a software version.
Once attacker knows the version installed, he can exploit published vulnerabilities. So it will be useful to know it when doing penetration ...
5
votes
1answer
89 views
Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?
I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
0
votes
1answer
629 views
More information about CVE-2012-0883 vulnerability
I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883
Second, I need to know , what mean DSos mentioned on the ...
0
votes
1answer
117 views
why CVSS give a score of 0.66 for a full impact on CIA?
By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values for confidentiality, integrity and availability:
none : 0.0
partial impact : ...
2
votes
3answers
319 views
Is OpenSSL secure enough?
We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries.
It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
1
vote
1answer
281 views
Where do I find more information about a given hacking attempt requests to my website?
Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:
Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
1
vote
2answers
302 views
What are best practices for implementing Remote Desktop within a corporation?
After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution' I have been looking for a hardening checklist or in the scenario that I am an ...
-2
votes
1answer
109 views
Why did I get unresponsive script when I start my system and open web browser? [closed]
The script on opening web broswersays Warning: Unresponsive Script
A script on this page may be busy,or it may have stopped responding.You can stop the script now,or you can continue to see if the ...
3
votes
2answers
165 views
How can I report an ecommerce site in violation of security practices?
I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
4
votes
2answers
676 views
Fuzzing with SPIKE - the \r\n not being taken into account
I would like to fuzz FTP protocol, and currently I have the following:
s_read_packet();
s_string("USER test\r\n");
s_read_packet();
s_string("PASS test\r\n");
s_read_packet();
I've also tried ...
13
votes
4answers
938 views
Security risks of scanning an unknown QR code
What are the security risks of scanning a QR code from an untrusted source?
If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
2
votes
3answers
480 views
How does Facebook avoid crawling over their site?
I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
4
votes
2answers
216 views
Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?
Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
0
votes
3answers
1k views
Is diskcryptor really secure?
Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
3
votes
1answer
383 views
How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
3
votes
1answer
150 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
2
votes
4answers
652 views
Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers.
Additional integration ...
1
vote
2answers
90 views
Can I instruct a Telco to prevent 2G connections from our phones?
Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices?
Some cell phones are unable to ...
4
votes
2answers
311 views
Could the bcrypt-ruby binding be vulnerable?
While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
-1
votes
1answer
1k views
Dropbear SSH server use-after-free vulnerability
"This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a use after free condition which ...
2
votes
1answer
264 views
Can fuzzing be considered a software testing technique for any vulnerability type
I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:
Bypass a restriction or similar
...
2
votes
2answers
313 views
Vulnerabilities and Threats to Non Web Based Windows Applications
I believe that most people here are familiar with OWASP and their Top 10 project. When it comes to information systems these days it appears that there is a big focus on web application security and ...
1
vote
1answer
420 views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
1
vote
2answers
1k views
What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?
I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both.
Based on this blog, TLS ...
0
votes
2answers
365 views
TimThumb security alternative or fix?
"An image resizing utility called timthumb.php is widely used by many WordPress themes....The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code ...
3
votes
2answers
332 views
HTML Vulnerabilities
My question is three-fold.
Background
I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
1
vote
2answers
717 views
Microsoft ASMX Web Services Test form available on remote machines
I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
4
votes
2answers
479 views
Difference between vulnerabilities on windows/linux/mac for same program
If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
6
votes
2answers
341 views
Videos and visual tutorials on Format String Vulnerabilities
Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...
4
votes
1answer
345 views
Hubs, Switches, and Bridges - Flaws and Security Superiority
It just isn't clear to me which choice is good for creating small/intermediate networks.
I know one of flaws of Hubs is that they send all packets to all nodes connected to it, in contrast to Switch ...
-2
votes
2answers
123 views
Under what circumstances can two computers receive packets at the same public IP address? [closed]
Under what circumstances could two completely different machines receive packets at the same class C IP address that is not within the IANA-reserved private IPv4 network ranges?
