A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

5
votes
4answers
2k views

VGA/HDMI Based Attack

Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side? How about HDMI or DVI? And if so, are there known malware or PoCs to do that? or is it theoretically ...
1
vote
1answer
235 views

How to check www.abc.com/?page=xyz is vulnerable to RFI or not?

On my friends website when I typed www.abc.com/?page=non existing page, I got page not found error.But when I gave www.abc.com/?page=www.google.com I got blank white page.So is this website ...
0
votes
1answer
177 views

What vulnerabilities does a malware exploit? [closed]

I have a malware sample. I want to know what vulnerabilities does it exploit (and of which software). I tried analyzing it in IDA Free and it seems that the code was developed in Visual C/C++ runtime. ...
4
votes
1answer
2k views

How do I know if a font is malicious?

There are cases of fonts being used for exploiting vulnerabilities {for ex: ThreatPost, SecureList and F-Secure}. My question is if you ever get hands on such a font, how do you know that it is ...
16
votes
3answers
870 views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
2
votes
3answers
1k views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
1
vote
1answer
143 views

Notification or report for security problem of unix systems? [duplicate]

I have unix systems(Solaris,Oracle,Redhat vs).I have to control all system for security problem,bugs,patch,vulnerabilities I'm looking for securty information for all security issue After that I'll ...
-1
votes
3answers
622 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
-8
votes
1answer
2k views

What are the vulnerabilities on port 23? [closed]

I'm working on a pen-testing project and still in the beginning but I faced a switch with only 80 & 23 ports opened. How can I use these ports to attack that switch ?
1
vote
0answers
39 views

How would you find a complete list of a software's vulnerabilities? [duplicate]

I'm interested in the number of vulnerabilities over time, not in specific information about the vulnerabilities. I also don't expect any list to be completely authoritative. But what list could I ...
8
votes
3answers
7k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
3
votes
1answer
268 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
21
votes
6answers
2k views

Is there a guide of general/common IT vulnerabilities?

I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information). I do not want you to do the job for me, I just want to point me in the right direction: ...
5
votes
2answers
387 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
7
votes
3answers
3k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
18
votes
0answers
610 views

Where can I find a vulnerable operating system to practice pentests on? [duplicate]

I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
-6
votes
1answer
137 views

Breaking into your own systems [closed]

So as security professionals, most are overly paranoid about external hackers, leaks, etc. I'm looking for ideas on how one would go about testing their own systems, without signs that they were ...
7
votes
3answers
532 views

I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?

I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities. Rails has their own policy ...
4
votes
1answer
223 views

Switching to new encryption method (without losing data?)

Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
6
votes
3answers
3k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
8
votes
2answers
19k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
-3
votes
1answer
131 views

Why isn't AV software configured to recognize installed program vulnerabilities?

Background (not necessary to read): I've used a few different major AV programs day-to-day over the years, and not one has ever informed me I was running code with known vulnerabilities. Not only ...
2
votes
1answer
513 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
8
votes
4answers
14k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
3
votes
4answers
1k views

FireFox's restore previous session restores logins authenticated by server's sessions

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
1
vote
1answer
104 views

Recognizing malicious URL attempts against your website

On serveral websites I've run, I periodically see URLs run against my servers that look like this: /url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........ Does anyone recognize it? I've tried to ...
1
vote
4answers
212 views

Is there a need to define “language safety”?

Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
5
votes
2answers
8k views

ASP.NET vulnerability CVE-2008-5100 (assembly signing bypass): is there a fix?

The short version of this question is:  Is there a fix or mitigation for the ASP.NET vulnerability CVE-2008-5100, which allows attackers to bypass assembly digital signature checking? I'll ...
4
votes
2answers
314 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
0
votes
4answers
853 views

Dynamic tools to detect vulnerabilities in software applications written in c?

I am doing a project on detecting vulnerabilities in Windows 7/8 for software applications. Some of which some have source code available and some do not. Please suggest some technique that can help ...
0
votes
1answer
6k views

Dropbear SSH server use-after-free vulnerability

"This vulnerability is located within the Dropbear daemon and occurs due to the way the server manages channels concurrency. A specially crafted request can trigger a use after free condition which ...
21
votes
6answers
1k views

Why are vulnerabilities and lack of security possible in computers?

I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why doesn't the computer just do the things it is supposed to? Why do some people write malware, ...
1
vote
1answer
5k views

my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it

I am supposed to manage the content of a site and it got defaced. The site is hosted on a Linux server running Apache. Apache version: 2.2.13 Linux version is Debian 4.0(I think I don't really have ...
10
votes
3answers
2k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
8
votes
2answers
5k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
1
vote
2answers
2k views

Is SSH2 still vulnerable to man-in-middle attacks?

With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this ...
3
votes
2answers
3k views

How does Java 7 update 11 fix the security vulnerability?

There is a new Java released a couple days ago to resolve a hole that was recently discovered. (Oracle, US-CERT, NVD/NIST) In my initial reading about this update 11, I saw clearly where it by ...
7
votes
3answers
754 views

Risk Control - Ignored risks and accepted risks

Some say that ignored risks as part of an organization's behavior are much worse than accepted risks. I would like to test that axiom (in the eyes of some). When I am handling a risk and I choose to ...
5
votes
2answers
2k views

Fuzzing with SPIKE - the \r\n not being taken into account

I would like to fuzz FTP protocol, and currently I have the following: s_read_packet(); s_string("USER test\r\n"); s_read_packet(); s_string("PASS test\r\n"); s_read_packet(); I've also tried ...
5
votes
2answers
1k views

Security of NoSQL databases

Hopefully this isn't too broad. I've got little experience with NoSQL databases, but I know that they are rising in popularity. As a developer that is extremely concerned with security, I'm ...
2
votes
2answers
205 views

Access via http to other protocols and ports!

Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall. We know that he has developed an application (Console ...
5
votes
3answers
172 views

Disclosure in potential loss-of-life situations, with an uncooperative vendor

I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
7
votes
2answers
1k views

Vulnerabilities of Secure Shells

I ssh into my school's engineering computer to submit large programmin projects on a regular basis. Are there any vulnerabilities or worries about using this channel so frequently? What makes a secure ...
0
votes
1answer
864 views

apache mod_isapi public exploits

In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll. I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
5
votes
1answer
859 views

How are CVE identifiers assigned and managed?

CVE Identifiers (a.k.a. CVE IDs) are used to uniquely identifier a particular vulnerability. We've all seen them on various bulletins, and they're useful when researching an issue. But how are they ...
0
votes
2answers
607 views

OpenLDAP version 2.4.24 at risk? Site to check for known vulnerabilities with version used?

We use OpenLDAP version 2.4.24 $ /usr/local/libexec/slapd -VV @(#) $OpenLDAP: slapd 2.4.24 (Mar 5 2011 06:36:43) $ steve@sunblade2500:/bigdisk/SOURCES/S10/openldap-2.4.24/servers/slapd ...
8
votes
2answers
4k views

Not clear on ssl renegotiation vulnerabilty

When we read about TLS Renegotiation vulnerability, does it mean that a server is not supposed to ever accept renegotiation during a secure connection? I thought that by renegotiation security is ...
5
votes
4answers
755 views

Is not checking the src url a vulnerability?

By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
6
votes
1answer
570 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...