A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

learn more… | top users | synonyms (1)

7
votes
4answers
822 views

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
0
votes
0answers
18 views

viewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem

I am facing the problem "MyViewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem"- i have successfully completed my task and all are working fine. Issue ...
0
votes
0answers
26 views

Any known Dlink DIR 600M vulnerabilities?

Is there any known router authentication / login vulnerabilities or exploits for D-Link DIR 600M rev C1 firmware v3.02? The vulnerabilities of DIR 600 rev A and rev B are fixed in this model. Heres a ...
2
votes
1answer
95 views

Does MS16-087 imply Windows 7 computer vulnerable from Internet?

I just read the MS16-087 security bulletin and the articles by Vectra (who apparently discovered the vulnerability). As I understand it, MS Point and Print offered a delivery of print drivers from a ...
1
vote
2answers
53 views

Why are primes reused in Diffie-Hellman key exchanges?

Reading about the Logjam attack, I learned that Diffie-Hellman exchanges often* rely on the same particular 1024-bit key. I understand that back when DH was invented, even 512-bit keys were considered ...
3
votes
1answer
45 views

Are there open databases or sites similar to xssed.com, not necessarily about XSS?

Are there open databases, websites similar to xssed.com that are not necessarily about XSS, but where people report SQL inject-able websites or malware infected websites, for example? Potentially ...
-1
votes
0answers
23 views

Is this PHP code vulnerable to some attack? [migrated]

So I've made a PHP code for a login form. But i am not sure if this code was that safe, because i am not a security expert. I am using PDO statements in my code, here's my code : <?php class ...
3
votes
1answer
116 views

Found a security issue but no answer

I found a security issue on a politician personal site about two weeks ago. The site is still very active and has a bunch of visitors every day. The breach is very stupid and I'm probably not the ...
26
votes
4answers
4k views

What to do when I find a possible security vulnerability of public interest? [duplicate]

Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide. I am not an expert in security, but there ...
4
votes
2answers
145 views

What are the privacy and security risks associated with Intel's Management Engine and AMD's Platform Security Processor?

And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me? Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely ...
1
vote
2answers
75 views

Is there a practical way to identify security vulnerabilities that were published following a full disclosure policy?

I am conducting a study about the different vulnerability disclosure policies in an effort to determine how long it takes for a given vendor to issue a fix/patch, depending on how a given ...
-4
votes
1answer
42 views

Why is MITRE not changing CVE entries that are clearly incorrect? [closed]

Why is MITRE not changing some CVE entries that are clearly wrong? I have deeply analysed and highly tested some specific vulnerabilities. The CVE reports of them are in some cases inconsistent, ...
1
vote
2answers
33 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
0answers
35 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
6
votes
1answer
61 views

Are inactive vulnerable Wordpress plugins still unsafe?

When you install a plugin in WordPress you can choose to activate or deactivate it. Let's say you have a plugin of which the latest version is vulnerable to XSS for example and you're waiting for a ...
3
votes
3answers
413 views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
9
votes
3answers
92 views

Are virtualized environments vulnerable to the Row Hammer attack?

Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system. To ...
24
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
3
votes
2answers
94 views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
-4
votes
2answers
119 views

How do Hackers and Security Researchers Scan The Internet For Vulnerable Servers and Devices? [closed]

I would like to know how Security Researchers and hackers scan the internet to find vulnerable devices. For example in this article here, what sort of request/packets are those researchers sending to ...
3
votes
4answers
317 views

Is a computer more vulnerable if wireless is left on when booting?

Normally I switch off wireless on my laptop before I shut it down but I forgot to do this last night. So this morning, after I booted up the laptop, I saw the wireless notification on the bottom right ...
5
votes
1answer
89 views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
4
votes
1answer
147 views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
4
votes
1answer
58 views

Is it risky to report a security issue to a company or organization via non-dedicated channels?

I recently visited the website for a large, reputable company which serves a malicious script (it's a knockoff of one of the major analytics apps, with an inconspicuous, intentional typo in the source ...
5
votes
3answers
59 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
0
votes
0answers
33 views

Developing exploit with limited buffer space on Windows XP SP1

I am working on an exploit that has a very limited buffer space on Windows XP. DEP is disabled. The binary is a socket server that has a accepts commands, in one of those commands there is a stack ...
3
votes
1answer
109 views

Why POODLE vulnerability has for each byte a probability of 1/256 to get it in plaintext?

I read the Google paper about POODLE vulnerability (https://www.openssl.org/~bodo/ssl-poodle.pdf) and a lot of other articles. Each paper/article wrote about that you have to try it in average 256 ...
1
vote
4answers
79 views

Server echoes HTTP headers back to client - any security issues with that?

Im troubleshooting a server that behaves a bit odd. If I make a request that looks like this: GET / HTTP/1.1 Connection: close Host: hostname Someheader: somevalue Location: Woot? Set-Cookie: test=...
1
vote
1answer
43 views

Difference between local and physical attack vector in CVSS version 3?

In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical. Say, if I want to report "absence of logout button" I will use physical as ...
8
votes
2answers
2k views

What does “exploit price” on vuldb.com means?

I was checking vuldb.com, and they state in one of the boxes: Top vulnerabilities with the highest current exploit price of the current month. The evaluation happens multiple times per day. ...
0
votes
2answers
109 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
1
vote
1answer
27 views

Is the FIPS module of openSSL with fixed base address a security risk?

The latest openSSL library has a FIPS module which needs to be built with a fixed base address to be called FIPS compliant. The rationale behind this is that having a fixed base address enables them ...
1
vote
0answers
41 views

“Rollback process” for different penetration testing in case of something goes wrong? [closed]

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
-1
votes
1answer
58 views

Remote Help HTTP GET Request Format String Denial Of Service Vulnerability

Is there any solution for "HTTP GET Request Format String Denial Of Service Vulnerability" in the Remote Help software? I have referred many places but I could not find a solution. Please refer the ...
75
votes
8answers
18k views

How is 'Removing RAM' a security risk?

Today I was watching a video on 'Ethical Hacking' where, while discussing hardware attacks, the narrator said: Removing RAM or components from a desktop or a laptop Here's a screenshot: I ...
0
votes
0answers
44 views

What's is a security vulnerability that lets you inject server-side code called?

What is the name for a security vulnerability, that lets you inject server-side code into one of their server-sides pages (say PHP or ASPX)? I have googled 'Code Injection' though I'm not sure this is ...
-1
votes
1answer
67 views

Testing File Upload Functionality

I want to test a file upload functionality and I wasn't able to upload exe files, but I could upload file.exe.jpg (adding jpg extension). What threat this file possesses after it uploaded on the ...
4
votes
2answers
78 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
1
vote
1answer
80 views

How can an un-trusted device connected to the LAN network infect others operating systems?

I have a various devices on my LAN network (Linux, Windows, Android device..), sometimes i allow others to connect to my LAN through , it is not possible to verify the safety of their machines, Let's ...
0
votes
0answers
46 views

Deciding on payload

I am new to penetration testing and I am trying to understand how to choose a payload and why. For example I set up 2 virtual machines 1 with Kali Linux and a Windows XP SP2. On a previous experience ...
2
votes
2answers
121 views

Known vulnerabilities of GOST

Are there any known vulnerabilities in the GOST block cipher (GOST 28147-89)? Spcifically, I'm thinking about i.e. "master keys" which intentionally exist and are used i.e. by the Russian government. ...
60
votes
3answers
4k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
-1
votes
1answer
36 views

What are the most important vulnerabilities must be where professionalism [closed]

As we know that the vulnerabilities are many and varied, but what are the vulnerabilities in most locations and which need to be addressed and the focus on.
3
votes
1answer
43 views

How to contact a tech company's CERT?

Given I discovered a vulnerability in a product, e.g. a networking product, and can't find the email address of neither their CERT nor a disclosure contact, how should I report the vulnerability? ...
4
votes
1answer
83 views

Security vulnerability of voice authentication in phone services

Having been asked if I want to opt for voice authentication when using a phone service, I was wondering about the security vulnerabilities of an authentication method which is relatively new to me. ...
9
votes
5answers
2k views

Can we trust the information displayed by the linux utility commands for a vulnerable machine?

After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ...
5
votes
1answer
66 views

How dangerous is referencing a variable out of its lifetime

I understand that referencing a variable out of its lifetime is a dangerous practice, and can enable someone to seriously circumvent the program logic. However the CERT C Programming Language Secure ...
1
vote
2answers
454 views

How to prevent the latest ImageMagick vulnerability?

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
2
votes
1answer
62 views

How to identify and patch a hardware vulnerability?

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of ...
5
votes
2answers
101 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...