A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

4
votes
1answer
232 views

Switching to new encryption method (without losing data?)

Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
4
votes
2answers
317 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
4
votes
2answers
162 views

Taking action for exploit attempts

Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
4
votes
2answers
75 views

Software Library Vulnerability Tracking

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities. Is anyone aware of any comprehensive data sources aside ...
4
votes
1answer
325 views

What are the major vulns that affect the Dalvik VM of Android?

I frequently hear about the security risks of using Android. But few people who write articles on this subject ever identify what parts of Android are at fault, nor do they identify design flaws. Can ...
4
votes
2answers
101 views

How do I know that I'm vulnerable to the: “ Coordinated Website Compromise Campaigns Continue to Plague Internet ”

http://blogs.cisco.com/security/mass-compromise-of-the-obsolete/ and: All Redhat/CentOS versions plus nearly 100% of linux-based routers run 2.6 Since the article is extremely ...
4
votes
1answer
768 views

How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?

I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
4
votes
2answers
3k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
4
votes
2answers
887 views

What is the impact of the Bluebox Android APK integrity vulnerability?

Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media. The title of the post is "Uncovering Android Master Key" - ...
4
votes
1answer
158 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
3
votes
7answers
820 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
3
votes
4answers
1k views

FireFox's restore previous session restores logins authenticated by server's sessions

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
3
votes
2answers
970 views

HTML Vulnerabilities

My question is three-fold. Background I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
3
votes
2answers
3k views

How does Java 7 update 11 fix the security vulnerability?

There is a new Java released a couple days ago to resolve a hole that was recently discovered. (Oracle, US-CERT, NVD/NIST) In my initial reading about this update 11, I saw clearly where it by ...
3
votes
2answers
973 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
3
votes
3answers
858 views

Are there known hacks or security problems on broadband USB dongles?

USB broadband dongles seem to be common everywhere now though I'm not sure what the most widely accepted name for them is. In case I'm using poor terminology I'm referring to USB sticks which contain ...
3
votes
1answer
3k views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
3
votes
4answers
224 views

Vulnerablity counts by platform

I've been asked to compile a list of the number of published web vulnerabilities or exploits grouped by platform. With the understanding and caveat that numbers are just statistics, shouldn't be ...
3
votes
1answer
855 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
3
votes
2answers
2k views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
3
votes
1answer
282 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
3
votes
1answer
540 views

WPA vulnerabilities for pentest

As I am a network&IT enthusiast, I was asked by a friend to pentest his WPA network. I'm wondering if there is anything else I can do beside a bruteforce attack, trying the KARMA attack on ...
3
votes
1answer
419 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
3
votes
2answers
271 views

Fuzzing and its impact on testing environment

I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests. I'm ...
3
votes
2answers
325 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
3
votes
1answer
46 views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
3
votes
1answer
602 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
3
votes
1answer
443 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
3
votes
1answer
470 views

Are OpenJDK and non-Windows systems vulnerable to the Sept. 25th 2012 Java vulnerability?

I have heard of this vulnerability, but although it was announced on the Full Disclosure list, it does not provide any details (other than a severity assessment). Does anyone have more info than me, ...
3
votes
3answers
53 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
3
votes
1answer
101 views

Test suite for a white-box fuzzer

I have created a white-box fuzzer by extending the Crest. Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool. where i can find ...
3
votes
2answers
112 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
3
votes
2answers
4k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
2
votes
3answers
811 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
2
votes
2answers
460 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
2
votes
2answers
796 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...
2
votes
3answers
2k views

Vulnerabilities of RFID Smartcards

Recently my organization wants to move into the smart card system instead of static password. We want to move the entire infrastructure to the smartcard system. we are looking for a single smartcard ...
2
votes
1answer
422 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
2
votes
2answers
2k views

Security behind the windows 8 eye

I use the Windows 8 operating system. Whenever I navigate to the login page of Internet Explorer 10, or even the login screen of the operating system, I see an eye symbol at the end of the password ...
2
votes
2answers
210 views

Access via http to other protocols and ports!

Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall. We know that he has developed an application (Console ...
2
votes
3answers
2k views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
2
votes
2answers
2k views

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

I am no expert in this area but after some searching I am not too sure about the solution. An external vendor doing a pentration test on our server reported that we have ...
2
votes
2answers
783 views

Interesting article on a vulnerability found in Tor

This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out ...
2
votes
2answers
676 views

List of most common network vulnerabilities a la OWASP Top 10 [closed]

I am trying to find the most commonly used attack vectors/techniques on computer networks in the style of the owasp top 10, for my thesis work. The reports shouldn't be older than 2-3 years. Can you ...
2
votes
3answers
1k views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
2
votes
1answer
342 views

How does malware such as Stuxnet and Flamer propagate through USB memory sticks?

The best explanation I found is from this article but it still is unclear to me. Apparently a new vulnerability has been found involving .lnk files where when a folder on the memory stick containing ...
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
3answers
73 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
2
votes
1answer
65 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android ...
2
votes
3answers
585 views

Can I tell which applications embed Internet Explorer at a command prompt?

A recently discovered vulnerability affects Internet Explorer versions up to version 9, running on Windows XP, Vista, and Windows 7. This arstechnica article quotes HD Moore as saying, Just keep ...