Questions tagged [cve]

Common Vulnerabilities and Exposures (CVE) is a dictionary to describe known vulnerabilities.

Filter by
Sorted by
Tagged with
1 vote
1 answer
156 views

Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?

I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already. Information Disclosure (inodes) This article titled: "...
Bob Ortiz's user avatar
  • 6,661
0 votes
2 answers
85 views

Not requiring POST requests... results in a CSRF vulnerability?

I'm setting up a Jenkins server, and ran across a reported vulnerability, SECURITY-3033, also identified as CVE-2023-37954: Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST ...
A. R.'s user avatar
  • 145
2 votes
1 answer
72 views

Where to query for CVEs present in a version of a software project like npm packages of python modules?

In node, I can run npm audit and it will show me known vulnerabilities for the versions my dependencies are using. That's cool and all, but I'd like to be able to do the following, on some website or ...
KoenDG's user avatar
  • 21
0 votes
1 answer
47 views

How can I get CISA weekly summary sorted by vendor rather than by CVE?

I subscribe to the CISA's weekly vulnerability summary email. This USED to come sorted by vendor/product, so I could quickly skip over the Cisco and Wordpress vulnerabilities to check the stuff I care ...
Old Bald Guy's user avatar
1 vote
1 answer
174 views

Vulnerability scanning on target Android device

Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network? If not, is there any specific scanning tool that scans for CVE on ...
Ajay's user avatar
  • 41
1 vote
1 answer
86 views

Github repos with CVEs mentioned and no real content

When I look for proof-of-concepts of a security vulnerability, I often see this kind of Github repositories: https://github.com/Satheesh575555/linux-4.19.72_CVE-2023-0386 https://github.com/nidhi7598/...
Thanh Bui's user avatar
  • 232
0 votes
0 answers
216 views

Help creating an exploit for CVE-2019-11500

I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for ...
pwhx's user avatar
  • 1
2 votes
1 answer
166 views

How to Approach CVEs Marked as "DISPUTED" and "WON'T FIX" in PCI-DSS Pentest

When conducting penetration testing in a PCI-DSS compliance context, we found a known security vulnerability that's identified by a CVE number. In this case, the finding in question is CVE-2016-20012, ...
xpelican's user avatar
0 votes
1 answer
443 views

CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API

I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
Tlopasha's user avatar
0 votes
1 answer
90 views

Filter CVEs by affected OS

Is it possible to filter CVEs by affected platform/OS? Some sources do provide this, like exploit-db, but the main vulnerability source NVD, National Vulnerability Database, doesn't seem to have such ...
e-epsojn's user avatar
1 vote
0 answers
230 views

Am I exploitable to CVE-2023-20862?

I am trying to analyze whether I am exploitable to the new CVE in spring security. As per Spring they mention the following: Specifically, an application is vulnerable when any of the following is ...
ethicalhacker's user avatar
0 votes
0 answers
154 views

CVE-2021-22123 fortiweb bypass?

As a cybersecurity enthusiast, I tried to do the following exercise : A Fortiweb-VM Version 6.3.11 linked to a DVWA (vulnerable platform), with a burp, I took a request of the Fortiweb platform and ...
security enthusiast's user avatar
1 vote
2 answers
90 views

How to monitor for vulnerabilities across your company stack?

Let's say a software company XYZ is using a variety of 3rd party vendors - as an example, it could use: Lastpass as a company password manager; Azure B2C as the authentication framework for the ...
littlebobbytables's user avatar
1 vote
0 answers
117 views

Is there a database that classifies NPM library vulnerabilities as exploitable vs. benign in the browser?

I maintain several Angular apps, which contain thousands of dependencies on NPM packages. GitHub's Dependabot notifies me of new known vulnerabilities every week (from the CVE database). For example, ...
Jonathan Fuerth's user avatar
2 votes
1 answer
114 views

What're the most common vulnerabilities/weaknesses an attacker would exploit to gain SSH access to a container?

Fair warning - I am a security newbie. In all container escape/breakout vulnerability scenarios I've read (CVE-2022-0185), the author assumes or states that the attacker already had shell or SSH ...
Patrick Burke's user avatar
2 votes
1 answer
283 views

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application. However, due to the original KeePass being Windows-specific, I've ...
DannyNiu's user avatar
  • 370
1 vote
1 answer
142 views

Does downstream software that inherits vulnerable code need its own CVE submission?

A vulnerability could spread from one software to downstream software projects that import/use the software. If the original software has already requested a CVE ID and disclosed the vulnerability to ...
user288999's user avatar
1 vote
0 answers
172 views

Different results for CPE search on NVD

I usually stick to finding the right CPE candidate for product-version I am interested in by using the Search Vulnerability Database with Search Type selected as Advanced and then narrowing down from ...
Youbecks003's user avatar
1 vote
1 answer
133 views

What is the attack surface of CVE-2014-3802?

CVE-2014-3802 says that it allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file. The ZDI page says that: User interaction is ...
Motti's user avatar
  • 111
0 votes
1 answer
453 views

Clarification on vulnerability statuses

What do statuses of Ubuntu and Debian security trackers mean exactly in plain of definitely vulnerable\definitely not vulnerable\unknown? I have found this answer How to read CVE - 2016 - 5696 ...
onaonoamemeamet's user avatar
0 votes
0 answers
57 views

Does a structural representation of a CVE's description exist?

CVE descriptions are sometimes written with the proposed generic template from Jonathan Evans. For instance: [VULNTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] allows [ATTACKER] to [IMPACT] via ...
ammerzon's user avatar
  • 101
0 votes
1 answer
142 views

Vulnerable Components CVSS Score

How do you map vulnerable components' CVSS scores? Do you use the CVE CVSS score? Do you calculate again? For example: A host is using a component that has a CVE for a high vulnerability. Do you ...
Ton Lim's user avatar
1 vote
0 answers
169 views

What is missing to reproduce CVE-2022-32250?

I want to reproduce CVE-2022-32250. I found this this git repo as a repository for the exploit and a code proof of concept provided here. So I installed Ubuntu 22.04 on VM, and installed kernel ...
E Epsylon's user avatar
1 vote
1 answer
116 views

Get in depth information about vulnerability from a CVE

I'm trying to understand how to get more information about a vulnerability given a CVE. I noticed that some CVEs, on websites like https://www.cvedetails.com, have got references to articles or to ...
Fral's user avatar
  • 13
0 votes
0 answers
493 views

CVE 2022-21661 - WP Injection replication

I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan. I'm trying to submit a POST request ...
Giacomo's user avatar
0 votes
1 answer
151 views

Gitlab CVE-2022-1175

I'm trying to get information about CVE-2022-1175 which is corrected in gitlab versions 14.9.2, 14.8.5 and 14.7.7 (https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-...
Zumo de Vidrio's user avatar
1 vote
1 answer
214 views

Can one security advisory affect more than one RPM package?

On RedHat and derived Linux distributions, vulnerability warnings are available in form of security advisories which are usually derived from CVEs. The rules for the CVE numbering authorities state ...
AdminBee's user avatar
  • 113
0 votes
2 answers
405 views

Where to find detailed info of how to exploit known vulnerabilities?

With most vulnerabilities, I see just summaries and not much detail about what is happening. Is there a good location where you can find demos of CVEs? For example, a CVE would say that the router ...
adrianTNT's user avatar
  • 140
0 votes
1 answer
208 views

Why is the fix for CVE-2022-0839 on a test class?

I am analyzing CVE-2022-0839. When checking the commit, I don't understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn't the fix be done in the ...
ethicalhacker's user avatar
0 votes
0 answers
279 views

how to know CVE affects which Jar/artifact?

When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused. Let's take as an example this CVE: CVE-2022-22978 In the description: "In Spring Security ...
ethicalhacker's user avatar
0 votes
1 answer
173 views

Kubernetes user impersonation to obtain exec privileges

I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
SarahAlexa's user avatar
0 votes
1 answer
131 views

Stack vs Heap exploit, which have more CVE documented?

I tried to google this topic but most of them are conflicting each other. On the other side, I found a case where I can use either stack (local variable) or heap for a dynamic string. It's C by the ...
Thor-x86_128's user avatar
0 votes
0 answers
86 views

trying to test the vulnerability CVE 2015-0205 for university project

I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes. I found this explanation of CVE-2015-0205: ...
OpenSSL_learner's user avatar
1 vote
0 answers
53 views

Should vendors add their CPEs in the log4j NIST entry?

Software that has packaged a vulnerable version of the log4j library is considered vulnerable to CVE-2021-44228 or "log4shell". When I look at the NIST definition I can see that the ...
Neil P's user avatar
  • 181
0 votes
0 answers
1k views

Logback's CVE-2021-42550 - Is this really a vulnerability?

I'm really struggeling with understanding CVE-2021-42550. Logback says: A successul RCE attack with CVE-2021-42550 requires all of the following conditions to be met: write access to logback.xml use ...
user3240316's user avatar
1 vote
1 answer
103 views

How can I be alerted for security breach, bulletin, CVE for a list of manufacturers

I'm trying to find a solution to be able to be alerted of security alerts for a list of software, hardware that we are using. I've found https://www.secalerts.co, which looks good, but it seems that ...
Loïs's user avatar
  • 13
10 votes
2 answers
2k views

Does CVE-2021-42694 affect only compiled code?

A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0. Does it only affect code compiled from sources with disallowed unicode characters? RHEL ...
Michael's user avatar
  • 1,479
-1 votes
1 answer
245 views

Ubuntu CVE Score - Gained acces level:None - Does it mean personal data is safe on ubuntu?

I was studying the following page listing all the vulnerabilities of ubuntu. CVE Ubuntu What I found surprising is that all vulnerabilities report that "gained access level: None". Does that ...
CuriousIndeed's user avatar
1 vote
0 answers
145 views

Check website for deprecated libraries and known CVEs [closed]

I was curious if anyone knew of a tool, website, or browser extension that will tell you if a site has deprecated libraries and if there are CVEs related to that. I currently have burpsuite pro and ...
Patrick-not-spongebob's user avatar
0 votes
1 answer
179 views

Determining applicability of CVEs without CPEs?

I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
Vjz's user avatar
  • 11
7 votes
2 answers
978 views

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE. We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
E235's user avatar
  • 173
7 votes
1 answer
315 views

What exactly is CVE-2021-23978 (from MSFA2021-08 in Mozilla Firefox)?

A number of vulnerabilities were fixed in Firefox in the latest update. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information: Mozilla ...
forest's user avatar
  • 66.5k
4 votes
3 answers
2k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
Michael's user avatar
  • 1,479
0 votes
1 answer
107 views

CVE submission - Denial of Service vs. Remote code execution

I wanted to ask how to deal with a new remote code execution vulnerability that has the same origin as an already found Denial of Service vulnerability? Can I apply for a new CVE ID for this? This is ...
user445527's user avatar
0 votes
0 answers
493 views

Is Microsoft CVE-2020-1045 a credible threat?

Microsoft released CVE-2020-1045 in September 2020. A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser ...
speciesUnknown's user avatar
1 vote
1 answer
105 views

How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?

Let's consider the following code in a hypothetical C library. uint8_t size; uint8_t buf[128]; read(untrusted_fd, &size, 1); read(untrusted_fd, buf, size); In the early 2000s, it would be a ...
比尔盖子's user avatar
5 votes
2 answers
445 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
Whysmerhill's user avatar
1 vote
1 answer
115 views

CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
ChocolateOverflow's user avatar
2 votes
1 answer
107 views

Which CVE Numbering Authority (CNA) should I contact for a vulnerability found in the GNU Scientific Library?

I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it. According to the procedure explained here: https://cve....
zell's user avatar
  • 125
5 votes
1 answer
2k views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
Lucas Bustamante's user avatar

1
2 3 4 5