A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

4
votes
3answers
1k views

SCADA Operating System & Security Exploits

So I have a basic question on the SCADA operating system, which the manufacturers do not disclose. From my experience I can see VxWorks running in some of them, and Windows or Linux in some of them. ...
13
votes
2answers
958 views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
7
votes
2answers
986 views

What risks are inherent with connecting to an untrusted public key server?

Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here: Shouldn't GPG key fetching use a secure connection? ...you should not trust the key ...
6
votes
6answers
649 views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
10
votes
2answers
665 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
4
votes
2answers
3k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
6
votes
5answers
875 views

Naming convention based exploits

The book Web Hacking Exposed has a number of instances where the attacker would essentially use patterns in naming conventions to design attacks. Can any one point me to any study on ...
0
votes
1answer
367 views

What is the “Australian Failure”?

In the notes for my Computer Security course, the lecturer refers to the "Australian Failure" on slide 19. I'm assuming he's referring to a well known security system failure, but I can't find what it ...
9
votes
3answers
2k views

Exploit-db like websites, where people can search for security bugs

If someone has to decide between 2 very similar server programs, or operating systems, then it searches on sites like: http://www.exploit-db.com/search/ so that there he could get enough ...
11
votes
4answers
6k views

OpenBSD vs. NetBSD security

If i search for the two words: OpenBSD and NetBSD on: http://www.exploit-db.com/ then i get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD. So what are ...
6
votes
2answers
893 views

Where can I find a list of un-patched CVEs for a specific piece of software?

Is there a database of vulnerabilities somewhere, that can be queried in such a way as to return results for all non-patched vulnerabilities for a specific piece of software? For example, I would ...
6
votes
2answers
3k views

Known security vulnerabilities in JBoss 4.x.x?

We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but ...
10
votes
3answers
2k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
17
votes
7answers
624 views

which site do you use to view details of vulnerabilities? [closed]

Which site/sites do you guys use to view details of security vulnerabilities?
27
votes
7answers
505 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
5
votes
3answers
356 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ...
21
votes
6answers
2k views

Is there a guide of general/common IT vulnerabilities?

I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information). I do not want you to do the job for me, I just want to point me in the right direction: ...
11
votes
2answers
667 views

Risks of Using Google Native Client

I was wondering if there were any possible risks in using Google Native Client. I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your ...
7
votes
4answers
822 views

How big is the risk, to enable scripting in the Web browser?

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...
29
votes
4answers
7k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
26
votes
10answers
6k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
17
votes
6answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
22
votes
9answers
4k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
12
votes
4answers
14k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?