Questions tagged [cve]

Common Vulnerabilities and Exposures (CVE) is a dictionary to describe known vulnerabilities.

Filter by
Sorted by
Tagged with
0 votes
0 answers
62 views

trying to test the vulnerability CVE 2015-0205 for university project

I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes. I found this explanation of CVE-2015-0205: ...
user avatar
0 votes
0 answers
24 views

How could we fix Microsoft LDAP Enforce Channel Binding CVE-2017-8563?

I had a DC server running Microsoft Windows Server 2008 R2 x64. After a vulnerability scan launched on this server using Nexpose, the CVE-2017-8563 was reported by the vulnerability scanner with the ...
user avatar
  • 1
1 vote
0 answers
41 views

Should vendors add their CPEs in the log4j NIST entry?

Software that has packaged a vulnerable version of the log4j library is considered vulnerable to CVE-2021-44228 or "log4shell". When I look at the NIST definition I can see that the ...
user avatar
  • 181
0 votes
0 answers
803 views

Logback's CVE-2021-42550 - Is this really a vulnerability?

I'm really struggeling with understanding CVE-2021-42550. Logback says: A successul RCE attack with CVE-2021-42550 requires all of the following conditions to be met: write access to logback.xml use ...
user avatar
1 vote
1 answer
73 views

How can I be alerted for security breach, bulletin, CVE for a list of manufacturers

I'm trying to find a solution to be able to be alerted of security alerts for a list of software, hardware that we are using. I've found https://www.secalerts.co, which looks good, but it seems that ...
user avatar
  • 13
0 votes
0 answers
49 views

Atomikos dependency and CVE-2021-44228

In regard to the recent CVE-2021-44228 vulnerability, I've noticed that even the newest version of atomikos-util 5.0.8 is using a vulnerable version of Log4J 2.2 - as an internal dependency.. I was ...
user avatar
  • 243
0 votes
0 answers
53 views

How dangerous is a leaked private key from outside the infrastructure in context of: "Azure Active Directory keyCredential property Disclosure?"

Microsoft published the Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs which describes how to check if an Azure AD is ...
user avatar
10 votes
2 answers
2k views

Does CVE-2021-42694 affect only compiled code?

A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0. Does it only affect code compiled from sources with disallowed unicode characters? RHEL ...
user avatar
  • 1,457
-1 votes
1 answer
131 views

Ubuntu CVE Score - Gained acces level:None - Does it mean personal data is safe on ubuntu?

I was studying the following page listing all the vulnerabilities of ubuntu. CVE Ubuntu What I found surprising is that all vulnerabilities report that "gained access level: None". Does that ...
user avatar
  • 101
1 vote
0 answers
81 views

Check website for deprecated libraries and known CVEs [closed]

I was curious if anyone knew of a tool, website, or browser extension that will tell you if a site has deprecated libraries and if there are CVEs related to that. I currently have burpsuite pro and ...
user avatar
0 votes
1 answer
132 views

Determining applicability of CVEs without CPEs?

I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
user avatar
  • 1
5 votes
2 answers
830 views

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE. We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
user avatar
  • 151
7 votes
1 answer
266 views

What exactly is CVE-2021-23978 (from MSFA2021-08 in Mozilla Firefox)?

A number of vulnerabilities were fixed in Firefox in the latest update. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information: Mozilla ...
user avatar
  • 64k
4 votes
3 answers
2k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
user avatar
  • 1,457
0 votes
1 answer
96 views

CVE submission - Denial of Service vs. Remote code execution

I wanted to ask how to deal with a new remote code execution vulnerability that has the same origin as an already found Denial of Service vulnerability? Can I apply for a new CVE ID for this? This is ...
user avatar
0 votes
0 answers
238 views

Is Microsoft CVE-2020-1045 a credible threat?

Microsoft released CVE-2020-1045 in September 2020. A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser ...
user avatar
1 vote
1 answer
71 views

How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?

Let's consider the following code in a hypothetical C library. uint8_t size; uint8_t buf[128]; read(untrusted_fd, &size, 1); read(untrusted_fd, buf, size); In the early 2000s, it would be a ...
user avatar
4 votes
2 answers
304 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
user avatar
1 vote
1 answer
96 views

CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
user avatar
2 votes
1 answer
96 views

Which CVE Numbering Authority (CNA) should I contact for a vulnerability found in the GNU Scientific Library?

I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it. According to the procedure explained here: https://cve....
user avatar
  • 125
4 votes
1 answer
937 views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
user avatar
-1 votes
1 answer
186 views

Google says CVE-2020-15999 was for a zero day exploit found on 2020-10-19, but the CVE record was created on 2020-07-27. What am I missing?

There have been numerous reports in the last week about the Chrome exploit using a bug in the FreeType library. According to reports, this bug was found on 2020-10-19. https://chromereleases....
user avatar
3 votes
1 answer
451 views

Is disabling IPv6 an effective workaround for "Bad Neighbor" Vulnerability (CVE-2020-16898)?

CVE-2020-16898 is a remote code execution vulnerability caused by the improper handling of ICMPv6 Router Advertisement packets by Windows TCP/IP stack. Microsoft's recommended workaround is to disable ...
user avatar
3 votes
1 answer
3k views

WireGuard / CVE-2019-14899: How secure the protocol really is?

I've been using OpenVPN and SSH tunnels for a multitude of scenarios over the years and recently I've been earning a lot of buzz around the simplicity and security of WireGuard. Now I've found some ...
user avatar
  • 217
3 votes
3 answers
191 views

Applicability of CVE-2018-14721

My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
user avatar
0 votes
2 answers
746 views

How can I map CVEs to their underlying CWE?

I was tasked with developing a consistent, relatively complete map for CVEs to CWEs at my internship, and I'm kind of at a loss finding a method to find a 1-to-1 way to map CVEs onto CWEs. Ideally, ...
user avatar
0 votes
1 answer
197 views

How to find dates of a CVE?

Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?
user avatar
1 vote
1 answer
133 views

Does the DICOM file header gets lost when transferred over the network?

I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
user avatar
1 vote
0 answers
144 views

Exploit CVE-2020-0688 for older versions

I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised. The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
user avatar
0 votes
0 answers
273 views

Vulnerable Apache Tomcat server

I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617. Any Apache Tomcat ...
user avatar
0 votes
0 answers
129 views

Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?

My team and I have written a web app, and we had a bug report regarding a DoS vulnerability. This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
user avatar
0 votes
1 answer
320 views

CVE fields vulnerable_products vs whats in configuration

I would like to understand better the structure of the CVE. (For example) in CVE-2018-19081, vulnerable_products mention product Opticam i5. like so: "vulnerable_products": [ "cpe:2.3:o:...
user avatar
  • 53
-4 votes
1 answer
240 views

I found a security vulnerability in a web app developed by my university. Can it have a CVE number?

I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University. Using it I can get ...
user avatar
3 votes
1 answer
757 views

Sending a reverse shell command through the drupalgeddon vulnerability isn't working

I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine. the requests: -curl -k -s 'http://192.168.204.141/?q=...
user avatar
1 vote
0 answers
91 views

How do I sort a large number of security vulnerabilities (CVEs) by severity? [closed]

During the course of my work, I was enumerating about 14 IPs and now my next task is manual checking each of the 500+ CVEs I found. I would like to sort them by severity and automate this as much as ...
user avatar
  • 11
0 votes
0 answers
181 views

Telerik cve only find key?

I found that a website is using a version of telerik web ui that may be vulnerable to cve-2017-9248. However when i use the python script with command `python script.py -k https://www.website.com/...
user avatar
  • 19
0 votes
0 answers
106 views

How to remediate a CVE or find a work around before the patch is released?

I was going through set of security vulnerabilities reported in Oracle Critical Patch Update. I want to find out the standard process followed by developers/security people to mitigate these kind of ...
user avatar
  • 101
0 votes
0 answers
1k views

Is there a way to map each CVE to a technique/tactic in the mitre ATT&CK matrix?

The only 'solution' I thought of is linking a CVE to a CWE and then to a CAPEC (Method found in this link: How to find CAPEC items related to a CVE) but I am unable to get from a CAPEC attack pattern ...
user avatar
  • 1
10 votes
1 answer
339 views

How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?

What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
user avatar
  • 7,333
5 votes
2 answers
2k views

Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

I'm getting conflicting reports. Search in Google: "windows 7" fix CVE-2020-0601 The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7". Scrolling down ...
user avatar
0 votes
1 answer
291 views

Difference between CVE and OSVDB?

Can someone explain the differences between a CVE and an OSVDB identifier? Both seem to serve the purpose of uniquely identifying a vulnerability or an expose, however not every OSVDB entry also has a ...
user avatar
  • 165
0 votes
0 answers
117 views

Exploitation differences between Docker and VirtualBox for CVE-2010-4221

I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability. I ...
user avatar
  • 165
2 votes
0 answers
125 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
user avatar
  • 2,099
0 votes
2 answers
151 views

How Vulnerability scanners assign CVE codes to Vulnerability found

I just want to know how CVE codes are assigned by the vulnerability scanners, while it found the particular vulnerability.
user avatar
1 vote
0 answers
118 views

Why does CVE-2019-2130 show up in Ubuntu and NodeJS?

In the NVD report for CVE-2019-2130 it shows that the products that are affected are only Android, and the links found in the Mitre page of the CVE lead only to an Android report of the CVE. This is ...
user avatar
1 vote
2 answers
290 views

Can I trust that the Java CVE's contain only the affected versions?

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that ...
user avatar
  • 13
1 vote
3 answers
1k views

How to scan a list of RPM files for publicly declared (CVE) vulnerabilities?

Couldn't find a reliable tool to scan a list of CentOS or RHEL RPM files for vulnerabilities (e.g. list CVEs found for each file). The goal is to scan the RPM files for vulnerabilities before they ...
user avatar
  • 444
4 votes
1 answer
747 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
user avatar
  • 41
6 votes
2 answers
280 views

Can A chain of exploits count as a CVE?

If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits), but when used together in an exploit chain can achieve a meaningful ...
user avatar
  • 85
2 votes
1 answer
262 views

What does "Obtaining a CVE" mean

I've have seen the term around and I mostly get that it is referred to when someone reports a vulnerability to Mitre. But what does this mean practically? Are you listed somewhere as the reporter? ...
user avatar
  • 290

1
2 3 4 5