A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

0
votes
2answers
39 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
2
votes
1answer
2k views

How can you check and analyze SSL ports other than 443? [closed]

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
0
votes
1answer
60 views

Can CVEs (or any vulnerability) be dependent on one another?

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same ...
0
votes
0answers
40 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
16
votes
2answers
4k views

How exploitable is the recent UseRoaming SSH problem?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active ...
2
votes
3answers
4k views

Help configuring Cisco router

I have some network issues in my network due to misconfiguration of Cisco router and switches. Please give me some advice or solutions to fix these vulnerabilities and configuration issues. ...
10
votes
3answers
781 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
1
vote
1answer
22 views

How to patch haproxy for OpenSSL vulnerability USN-2830-1

This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on ...
1
vote
1answer
29 views

Reliable Sources for Software Vulnerability Patch Release dates

I have searched in NVD and realized that patch release dates are not published with the specific vulnerability information of an application. Other information like the "update date" do not ...
0
votes
0answers
30 views

Is there a way to link STIGs to CCEs?

A federal customer sent us a list of vulnerabilities for one of our RHEL6 systems that was generated by the Security Content Automation Protocol (SCAP) Compliance Checker (SSC). The findings are ...
1
vote
0answers
61 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
5
votes
0answers
316 views

How to protect from ROM-0 via port triggering?

I'm using an anti-virus that told me that my router can be compromised with the ROM-0 vulnerability. It told me to use "port forwarding" to fix it. But, my router have a "port triggering", which they ...
3
votes
3answers
474 views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
0
votes
0answers
44 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
5
votes
2answers
486 views

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like: # vim: set someoption=somevalue and will then set those options. This is awesome if ...
5
votes
1answer
151 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the ...
3
votes
3answers
45 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
1
vote
2answers
597 views

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

I am no expert in this area but after some searching I am not too sure about the solution. An external vendor doing a pentration test on our server reported that we have ...
6
votes
3answers
1k views

How to hack a Win95 machine?

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither ...
1
vote
2answers
32 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
1answer
98 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
10
votes
2answers
11k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
1
vote
1answer
38 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
12
votes
4answers
14k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
45
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
1
vote
1answer
73 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
0
votes
2answers
191 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new ...
27
votes
7answers
505 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
17
votes
6answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
0
votes
2answers
434 views

What current algorithms are considered (un)secure? [closed]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
3
votes
2answers
4k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
0answers
82 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection ...
1
vote
1answer
573 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
1
vote
2answers
79 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
10
votes
1answer
5k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
3
votes
3answers
114 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
2answers
134 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...
4
votes
4answers
11k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
0
votes
0answers
90 views

How do Common Vulnerabilities and Exposures (CVEs) work?

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages. I am looking for a ...
39
votes
3answers
30k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
0
votes
1answer
139 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
2
votes
1answer
53 views

Is auto-redirecting to another site a secure defense against POODLE?

Normally, servers that support SSL 3.0 are vulnerable to the POODLE attack. But, consider a server that has the following interesting combination of features: It supports SSL 3.0. If you connect to ...
13
votes
2answers
777 views

How to make a website patch their poor security?

I am following an online class from a local institution. Recently, I've noticed they don't hash passwords because they sent me my password by e-mail in clear text. The website has a lot of personal ...
0
votes
5answers
63 views

Where can I find a description list for major vulnerabilities? [closed]

I'm looking for a description list for major vulnerabilities such as SQLi, XSS etc. The format should be like this: Short Description: Description: Impact: Solution/How to prevent: ...
0
votes
0answers
118 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
6
votes
1answer
228 views

Does mutual SSL authentication increases protection against a Poodle attack?

Recently we found our self pondering whether a certificate based mutual SSL authentication protects against a Poodle attack over SSLv3? We’re stuck in a situation where a client-application only ...
2
votes
2answers
3k views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
1
vote
1answer
290 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
2
votes
1answer
64 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
1
vote
1answer
122 views

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)? From Mark's answer on ...