Questions tagged [cve]
Common Vulnerabilities and Exposures (CVE) is a dictionary to describe known vulnerabilities.
195
questions
0
votes
1answer
42 views
CVE submission - Denial of Service vs. Remote code execution
I wanted to ask how to deal with a new remote code execution vulnerability that has the same origin as an already found Denial of Service vulnerability? Can I apply for a new CVE ID for this? This is ...
0
votes
0answers
96 views
Is Microsoft CVE-2020-1045 a credible threat?
Microsoft released CVE-2020-1045 in September 2020.
A security feature bypass vulnerability exists in the way Microsoft
ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser ...
1
vote
1answer
30 views
How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?
Let's consider the following code in a hypothetical C library.
uint8_t size;
uint8_t buf[128];
read(untrusted_fd, &size, 1);
read(untrusted_fd, buf, size);
In the early 2000s, it would be a ...
4
votes
2answers
209 views
Why CVSS range 8 to 9 is almost inexistent
According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range.
Even compared to the low score ranges ...
1
vote
1answer
51 views
CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?
I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
2
votes
1answer
47 views
Which CVE Numbering Authority (CNA) should I contact for a vulnerability found in the GNU Scientific Library?
I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it.
According to the procedure explained here: https://cve....
3
votes
1answer
377 views
What is the Plundervolt attack?
CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack.
What is the Plundervolt attack?
Should domestic users be afraid of ...
-1
votes
1answer
136 views
Google says CVE-2020-15999 was for a zero day exploit found on 2020-10-19, but the CVE record was created on 2020-07-27. What am I missing?
There have been numerous reports in the last week about the Chrome exploit using a bug in the FreeType library. According to reports, this bug was found on 2020-10-19.
https://chromereleases....
2
votes
1answer
220 views
Is disabling IPv6 an effective workaround for “Bad Neighbor” Vulnerability (CVE-2020-16898)?
CVE-2020-16898 is a remote code execution vulnerability caused by the improper handling of ICMPv6 Router Advertisement packets by Windows TCP/IP stack. Microsoft's recommended workaround is to disable ...
2
votes
1answer
493 views
WireGuard / CVE-2019-14899: How secure the protocol really is?
I've been using OpenVPN and SSH tunnels for a multitude of scenarios over the years and recently I've been earning a lot of buzz around the simplicity and security of WireGuard. Now I've found some ...
3
votes
3answers
114 views
Applicability of CVE-2018-14721
My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
0
votes
2answers
159 views
How can I map CVEs to their underlying CWE?
I was tasked with developing a consistent, relatively complete map for CVEs to CWEs at my internship, and I'm kind of at a loss finding a method to find a 1-to-1 way to map CVEs onto CWEs. Ideally, ...
0
votes
1answer
60 views
How to find dates of a CVE?
Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?
1
vote
1answer
94 views
Does the DICOM file header gets lost when transferred over the network?
I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
1
vote
0answers
94 views
Exploit CVE-2020-0688 for older versions
I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised.
The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
0
votes
0answers
78 views
Vulnerable Apache Tomcat server
I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617.
Any Apache Tomcat ...
0
votes
0answers
91 views
Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?
My team and I have written a web app, and we had a bug report regarding a DoS vulnerability.
This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
0
votes
1answer
179 views
CVE fields vulnerable_products vs whats in configuration
I would like to understand better the structure of the CVE.
(For example) in CVE-2018-19081, vulnerable_products mention product Opticam i5. like so:
"vulnerable_products": [
"cpe:2.3:o:...
-4
votes
1answer
177 views
I found a security vulnerability in a web app developed by my university. Can it have a CVE number?
I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.
Using it I can get ...
2
votes
1answer
178 views
Sending a reverse shell command through the drupalgeddon vulnerability isn't working
I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine.
the requests:
-curl -k -s 'http://192.168.204.141/?q=...
1
vote
0answers
40 views
How do I sort a large number of security vulnerabilities (CVEs) by severity? [closed]
During the course of my work, I was enumerating about 14 IPs and now my next task is manual checking each of the 500+ CVEs I found. I would like to sort them by severity and automate this as much as ...
0
votes
0answers
116 views
Telerik cve only find key?
I found that a website is using a version of telerik web ui that may be vulnerable to cve-2017-9248.
However when i use the python script with command
`python script.py -k https://www.website.com/...
0
votes
0answers
55 views
How to remediate a CVE or find a work around before the patch is released?
I was going through set of security vulnerabilities reported in Oracle Critical Patch Update. I want to find out the standard process followed by developers/security people to mitigate these kind of ...
0
votes
0answers
644 views
Is there a way to map each CVE to a technique/tactic in the mitre ATT&CK matrix?
The only 'solution' I thought of is linking a CVE to a CWE and then to a CAPEC (Method found in this link: How to find CAPEC items related to a CVE) but I am unable to get from a CAPEC attack pattern ...
10
votes
1answer
293 views
How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?
What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
5
votes
2answers
2k views
Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?
I'm getting conflicting reports.
Search in Google: "windows 7" fix CVE-2020-0601
The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7".
Scrolling down ...
0
votes
1answer
86 views
Difference between CVE and OSVDB?
Can someone explain the differences between a CVE and an OSVDB identifier?
Both seem to serve the purpose of uniquely identifying a vulnerability or an expose, however not every OSVDB entry also has a ...
0
votes
0answers
59 views
Exploitation differences between Docker and VirtualBox for CVE-2010-4221
I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability.
I ...
2
votes
0answers
70 views
Are there any JRE/JDK exploits that do not require the presence of applets or plugins?
For triggering a Java exploit should applets be enabled in the user's machine?
That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
0
votes
2answers
100 views
How Vulnerability scanners assign CVE codes to Vulnerability found
I just want to know how CVE codes are assigned by the vulnerability scanners, while it found the particular vulnerability.
1
vote
0answers
79 views
Why does CVE-2019-2130 show up in Ubuntu and NodeJS?
In the NVD report for CVE-2019-2130 it shows that the products that are affected are only Android, and the links found in the Mitre page of the CVE lead only to an Android report of the CVE.
This is ...
1
vote
2answers
139 views
Can I trust that the Java CVE's contain only the affected versions?
When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description.
However, I'm not confident that ...
1
vote
3answers
561 views
How to scan a list of RPM files for publicly declared (CVE) vulnerabilities?
Couldn't find a reliable tool to scan a list of CentOS or RHEL RPM files for vulnerabilities (e.g. list CVEs found for each file).
The goal is to scan the RPM files for vulnerabilities before they ...
1
vote
1answer
371 views
Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?
Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
6
votes
2answers
225 views
Can A chain of exploits count as a CVE?
If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits),
but when used together in an exploit chain can achieve a meaningful ...
2
votes
1answer
152 views
What does “Obtaining a CVE” mean
I've have seen the term around and I mostly get that it is referred to when someone reports a vulnerability to Mitre.
But what does this mean practically? Are you listed somewhere as the reporter? ...
0
votes
1answer
269 views
Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation?
I found an interesting blog post A Deep Analysis of the Microsoft Outlook Vulnerability CVE-2018-8587 about Microsoft Outlook heap buffer overflow vulnerability where is described how Microsoft ...
3
votes
1answer
291 views
How long it takes to receive CVE-ID from cve.mitre.org?
I had applied for CVE ID at https://cveform.mitre.org/.
I did followed their guidelines, and did exactly as their instructions said (didn't add PGP key as it seems optional). It's been 2 month since ...
3
votes
1answer
2k views
API to Get CVE Info [closed]
I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
1
vote
0answers
68 views
CVE vulnerable apps repository [closed]
According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists?
Exploit-DB offers vulnerable apps, i.e. for:
https://www.exploit-db.com/exploits/46962
it is ...
0
votes
1answer
1k views
Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6
How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
2
votes
1answer
640 views
nvd json database without vendor and product info
I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED
I see many entries, where vendor product information is not filled in (cve->affects->...
3
votes
1answer
124 views
How to request CVE if CNA didn't provide an answer
A couple of weeks ago I have found a vulnerability in a product. I have contacted them reporting it a week ago and also to get the CVE.
I didn't receive any answer from the mailing list and I would ...
57
votes
6answers
8k views
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
2
votes
2answers
4k views
How do the CVE-2018-10562 and CVE-2018-10561 exploits work?
https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
Firstly, the use of 'GPON' I find misleading because this vulnerability is to do with the routers and webservers and not the access ...
0
votes
1answer
67 views
Is CVE2012-5373 fixed in OpenJDK7?
Can anyone please tell me if CVE2012-5373 is fixed in OpenJDK7? I have searched for the fix details, but I couldn't find any.
9
votes
1answer
306 views
What is the reason for the increase of CVEs since 2017?
According to CVEdetails.com, there were 6447 CVEs in 2016.
In 2017 there were 14714 CVEs. That's 128% more than in 2016.
Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
136 views
Can a CVE be removed from NVD database?
Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or ...
1
vote
2answers
162 views
Risk and probability from CVE
How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14),
The cost is derived from the attack tree, and risk and probability are
based on CVE
...
1
vote
1answer
175 views
Exploit database for NVD vulnerabilities [closed]
I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
