The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
2answers
75 views

Is there a practical way to identify security vulnerabilities that were published following a full disclosure policy?

I am conducting a study about the different vulnerability disclosure policies in an effort to determine how long it takes for a given vendor to issue a fix/patch, depending on how a given ...
8
votes
2answers
2k views

What does “exploit price” on vuldb.com means?

I was checking vuldb.com, and they state in one of the boxes: Top vulnerabilities with the highest current exploit price of the current month. The evaluation happens multiple times per day. ...
1
vote
2answers
142 views

What information to provide when submitting a vulnerability report to a bounty program?

After finding a vulnerability in a program, one can submit it to a bounty program, such as ZDI. According to ZDI's website, they will examine the vulnerability and possibly offers a bounty. If the ...
1
vote
3answers
479 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
1
vote
3answers
323 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
2
votes
1answer
126 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
6
votes
3answers
446 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
10
votes
2answers
192 views

What are the likely effects of increased government spending on “Cyber Weapons” on the software industry?

From the conference scene and news this year it seems probable that there's an increased amount of spending from governmental agencies on what it getting termed "Cyber Weapons". A key component of ...
4
votes
3answers
1k views

Vulnerable java applications

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
9
votes
2answers
187 views

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
7
votes
2answers
414 views

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
11
votes
2answers
382 views

Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...