A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

217
votes
4answers
96k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
198
votes
5answers
122k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
45
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
44
votes
3answers
37k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
33
votes
5answers
6k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
32
votes
10answers
7k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
31
votes
4answers
7k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
27
votes
7answers
525 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this ...
22
votes
9answers
5k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
22
votes
1answer
9k views

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
21
votes
6answers
2k views

Why are vulnerabilities and lack of security possible in computers?

I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why doesn't the computer just do the things it is supposed to? Why do some people write malware, ...
21
votes
6answers
2k views

Is there a guide of general/common IT vulnerabilities?

I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information). I do not want you to do the job for me, I just want to point me in the right direction: ...
21
votes
3answers
3k views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
20
votes
2answers
2k views

From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?

I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work? Please note that I am not looking for ...
18
votes
3answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
18
votes
0answers
615 views

Where can I find a vulnerable operating system to practice pentests on? [duplicate]

I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
17
votes
7answers
637 views

which site do you use to view details of vulnerabilities? [closed]

Which site/sites do you guys use to view details of security vulnerabilities?
17
votes
6answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
17
votes
4answers
2k views

Security risks of scanning an unknown QR code

What are the security risks of scanning a QR code from an untrusted source? If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
16
votes
2answers
5k views

How exploitable is the recent UseRoaming SSH problem?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active ...
16
votes
3answers
924 views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
15
votes
7answers
3k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
14
votes
4answers
14k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
13
votes
2answers
16k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
13
votes
2answers
781 views

How to make a website patch their poor security?

I am following an online class from a local institution. Recently, I've noticed they don't hash passwords because they sent me my password by e-mail in clear text. The website has a lot of personal ...
13
votes
7answers
26k views

Using google dorks for a specific site?

I need to see if a site I am testing is vulnerable to any of the multiple Google dorks that are available at sites like this and this. Traditionally, one uses a 'dork' by searching "Index ...
13
votes
2answers
1k views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
12
votes
5answers
2k views

Is replacing bash with another shell a prudent step?

Considering that RedHat and other major teams in business are conducting an audit in bash and have uncovered a few other vulnerabilities besides -7169 (-7186 and -7187), is it sensible to link /bin/sh ...
12
votes
4answers
7k views

OpenBSD vs. NetBSD security

If I search for the two words: OpenBSD and NetBSD on http://www.exploit-db.com/ then I get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD. So what are the ...
12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
12
votes
1answer
2k views

SSL TLS renegotiation vulnerability - current situation in clients

Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
11
votes
2answers
11k views

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
11
votes
2answers
704 views

Risks of Using Google Native Client

I was wondering if there were any possible risks in using Google Native Client. I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your ...
10
votes
3answers
834 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
10
votes
3answers
2k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
10
votes
2answers
683 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
10
votes
2answers
4k views

Not clear on ssl renegotiation vulnerabilty

When we read about TLS Renegotiation vulnerability, does it mean that a server is not supposed to ever accept renegotiation during a secure connection? I thought that by renegotiation security is ...
10
votes
1answer
5k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
9
votes
3answers
2k views

Exploit-db like websites, where people can search for security bugs

If someone has to decide between 2 very similar server programs, or operating systems, then it searches on sites like: http://www.exploit-db.com/search/ so that there he could get enough ...
8
votes
3answers
3k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
8
votes
4answers
15k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
8
votes
4answers
4k views

Are there any customizable vulnerability notification services? [duplicate]

Are there any services (free or otherwise) that provide information on new vulnerabilities for a given piece of technology? For example, say I want to be updated of all new Wordpress vulnerabilities ...
8
votes
2answers
22k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
8
votes
3answers
8k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
8
votes
2answers
5k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
8
votes
1answer
1k views

Is MediaWiki viable for sensitive information?

I was under the impression that MediaWiki, due to its nature as "open for all Wiki platform", is not tailored towards managing sensitive information. I found some warnings about this on the MediaWiki ...
8
votes
3answers
11k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
8
votes
1answer
983 views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
7
votes
4answers
897 views

How big is the risk, to enable scripting in the Web browser?

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...