Questions tagged [cve]
Common Vulnerabilities and Exposures (CVE) is a dictionary to describe known vulnerabilities.
225
questions
1
vote
0
answers
19
views
Is there a database that classifies NPM library vulnerabilities as affecting only the server side or only the client side?
I maintain several Angular apps, which contain thousands of dependencies on NPM packages. GitHub's Dependabot notifies me of new known vulnerabilities every week (from the CVE database).
For example, ...
- 111
1
vote
0
answers
43
views
What're the most common vulnerabilities/weaknesses an attacker would exploit to gain SSH access to a container?
Fair warning - I am a security newbie.
In all container escape/breakout vulnerability scenarios I've read (CVE-2022-0185), the author assumes or states that the attacker already had shell or SSH ...
2
votes
1
answer
183
views
Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?
CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.
However, due to the original KeePass being Windows-specific, I've ...
- 350
1
vote
1
answer
109
views
Does downstream software that inherits vulnerable code need its own CVE submission?
A vulnerability could spread from one software to downstream software projects that import/use the software. If the original software has already requested a CVE ID and disclosed the vulnerability to ...
- 21
1
vote
0
answers
37
views
Different results for CPE search on NVD
I usually stick to finding the right CPE candidate for product-version I am interested in by using the Search Vulnerability Database with Search Type selected as Advanced and then narrowing down from ...
- 185
1
vote
1
answer
85
views
What is the attack surface of CVE-2014-3802?
CVE-2014-3802 says that it
allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file.
The ZDI page says that:
User interaction is ...
- 111
0
votes
0
answers
83
views
Clarification on vulnerability statuses
What do statuses of Ubuntu and Debian security trackers mean exactly in plain of definitely vulnerable\definitely not vulnerable\unknown?
I have found this answer How to read CVE - 2016 - 5696 ...
0
votes
0
answers
34
views
Does a structural representation of a CVE's description exist?
CVE descriptions are sometimes written with the proposed generic template from Jonathan Evans. For instance:
[VULNTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] allows [ATTACKER] to [IMPACT] via ...
- 101
0
votes
1
answer
40
views
Vulnerable Components CVSS Score
How do you map vulnerable components' CVSS scores?
Do you use the CVE CVSS score? Do you calculate again?
For example: A host is using a component that has a CVE for a high vulnerability.
Do you ...
- 1
1
vote
0
answers
95
views
What is missing to reproduce CVE-2022-32250?
I want to reproduce CVE-2022-32250. I found this this git repo as a repository for the exploit and a code proof of concept provided here.
So I installed Ubuntu 22.04 on VM, and installed kernel ...
- 21
1
vote
1
answer
56
views
Get in depth information about vulnerability from a CVE
I'm trying to understand how to get more information about a vulnerability given a CVE. I noticed that some CVEs, on websites like https://www.cvedetails.com, have got references to articles or to ...
- 13
0
votes
0
answers
267
views
CVE 2022-21661 - WP Injection replication
I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan.
I'm trying to submit a POST request ...
- 1
0
votes
1
answer
123
views
Gitlab CVE-2022-1175
I'm trying to get information about CVE-2022-1175 which is corrected in gitlab versions 14.9.2, 14.8.5 and 14.7.7 (https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-...
- 101
1
vote
1
answer
94
views
Can one security advisory affect more than one RPM package?
On RedHat and derived Linux distributions, vulnerability warnings are available in form of security advisories which are usually derived from CVEs.
The rules for the CVE numbering authorities state ...
- 113
0
votes
2
answers
160
views
Where to find detailed info of how to exploit known vulnerabilities?
With most vulnerabilities, I see just summaries and not much detail about what is happening.
Is there a good location where you can find demos of CVEs?
For example, a CVE would say that the router ...
- 140
0
votes
1
answer
143
views
Why is the fix for CVE-2022-0839 on a test class?
I am analyzing CVE-2022-0839.
When checking the commit, I don't understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn't the fix be done in the ...
0
votes
0
answers
129
views
how to know CVE affects which Jar/artifact?
When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused.
Let's take as an example this CVE: CVE-2022-22978
In the description:
"In Spring Security ...
0
votes
1
answer
88
views
Kubernetes user impersonation to obtain exec privileges
I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
0
votes
1
answer
86
views
Stack vs Heap exploit, which have more CVE documented?
I tried to google this topic but most of them are conflicting each other. On the other side, I found a case where I can use either stack (local variable) or heap for a dynamic string. It's C by the ...
- 29
0
votes
0
answers
65
views
trying to test the vulnerability CVE 2015-0205 for university project
I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes.
I found this explanation of CVE-2015-0205:
...
1
vote
0
answers
43
views
Should vendors add their CPEs in the log4j NIST entry?
Software that has packaged a vulnerable version of the log4j library is considered vulnerable to CVE-2021-44228 or "log4shell". When I look at the NIST definition I can see that the ...
- 181
0
votes
0
answers
924
views
Logback's CVE-2021-42550 - Is this really a vulnerability?
I'm really struggeling with understanding CVE-2021-42550. Logback says:
A successul RCE attack with CVE-2021-42550 requires all of the following conditions to be met:
write access to logback.xml
use ...
- 33
1
vote
1
answer
78
views
How can I be alerted for security breach, bulletin, CVE for a list of manufacturers
I'm trying to find a solution to be able to be alerted of security alerts for a list of software, hardware that we are using.
I've found https://www.secalerts.co, which looks good, but it seems that ...
- 13
10
votes
2
answers
2k
views
Does CVE-2021-42694 affect only compiled code?
A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0.
Does it only affect code compiled from sources with disallowed unicode characters?
RHEL ...
- 1,477
-1
votes
1
answer
201
views
Ubuntu CVE Score - Gained acces level:None - Does it mean personal data is safe on ubuntu?
I was studying the following page listing all the vulnerabilities of ubuntu. CVE Ubuntu
What I found surprising is that all vulnerabilities report that "gained access level: None". Does that ...
- 101
1
vote
0
answers
98
views
Check website for deprecated libraries and known CVEs [closed]
I was curious if anyone knew of a tool, website, or browser extension that will tell you if a site has deprecated libraries and if there are CVEs related to that. I currently have burpsuite pro and ...
0
votes
1
answer
149
views
Determining applicability of CVEs without CPEs?
I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
- 11
6
votes
2
answers
891
views
Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?
I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE.
We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
- 163
7
votes
1
answer
305
views
What exactly is CVE-2021-23978 (from MSFA2021-08 in Mozilla Firefox)?
A number of vulnerabilities were fixed in Firefox in the latest update. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information:
Mozilla ...
- 65.7k
4
votes
3
answers
2k
views
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
We cannot remove RPMs or similar.
We can only change a configuration.
Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
- 1,477
0
votes
1
answer
102
views
CVE submission - Denial of Service vs. Remote code execution
I wanted to ask how to deal with a new remote code execution vulnerability that has the same origin as an already found Denial of Service vulnerability? Can I apply for a new CVE ID for this? This is ...
0
votes
0
answers
371
views
Is Microsoft CVE-2020-1045 a credible threat?
Microsoft released CVE-2020-1045 in September 2020.
A security feature bypass vulnerability exists in the way Microsoft
ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser ...
- 181
1
vote
1
answer
84
views
How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?
Let's consider the following code in a hypothetical C library.
uint8_t size;
uint8_t buf[128];
read(untrusted_fd, &size, 1);
read(untrusted_fd, buf, size);
In the early 2000s, it would be a ...
- 113
4
votes
2
answers
358
views
Why CVSS range 8 to 9 is almost inexistent
According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range.
Even compared to the low score ranges ...
- 562
1
vote
1
answer
105
views
CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?
I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
- 3,472
2
votes
1
answer
100
views
Which CVE Numbering Authority (CNA) should I contact for a vulnerability found in the GNU Scientific Library?
I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it.
According to the procedure explained here: https://cve....
- 125
5
votes
1
answer
1k
views
What is the Plundervolt attack?
CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack.
What is the Plundervolt attack?
Should domestic users be afraid of ...
- 153
-1
votes
1
answer
186
views
Google says CVE-2020-15999 was for a zero day exploit found on 2020-10-19, but the CVE record was created on 2020-07-27. What am I missing?
There have been numerous reports in the last week about the Chrome exploit using a bug in the FreeType library. According to reports, this bug was found on 2020-10-19.
https://chromereleases....
3
votes
1
answer
513
views
Is disabling IPv6 an effective workaround for "Bad Neighbor" Vulnerability (CVE-2020-16898)?
CVE-2020-16898 is a remote code execution vulnerability caused by the improper handling of ICMPv6 Router Advertisement packets by Windows TCP/IP stack. Microsoft's recommended workaround is to disable ...
4
votes
1
answer
4k
views
WireGuard / CVE-2019-14899: How secure the protocol really is?
I've been using OpenVPN and SSH tunnels for a multitude of scenarios over the years and recently I've been earning a lot of buzz around the simplicity and security of WireGuard. Now I've found some ...
- 227
3
votes
3
answers
214
views
Applicability of CVE-2018-14721
My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
0
votes
2
answers
1k
views
How can I map CVEs to their underlying CWE?
I was tasked with developing a consistent, relatively complete map for CVEs to CWEs at my internship, and I'm kind of at a loss finding a method to find a 1-to-1 way to map CVEs onto CWEs. Ideally, ...
0
votes
1
answer
267
views
How to find dates of a CVE?
Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?
- 11
1
vote
1
answer
141
views
Does the DICOM file header gets lost when transferred over the network?
I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
1
vote
0
answers
153
views
Exploit CVE-2020-0688 for older versions
I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised.
The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
- 11
0
votes
0
answers
382
views
Vulnerable Apache Tomcat server
I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617.
Any Apache Tomcat ...
0
votes
0
answers
129
views
Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?
My team and I have written a web app, and we had a bug report regarding a DoS vulnerability.
This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
- 1
0
votes
1
answer
372
views
CVE fields vulnerable_products vs whats in configuration
I would like to understand better the structure of the CVE.
(For example) in CVE-2018-19081, vulnerable_products mention product Opticam i5. like so:
"vulnerable_products": [
"cpe:2.3:o:...
- 53
-4
votes
1
answer
249
views
I found a security vulnerability in a web app developed by my university. Can it have a CVE number?
I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.
Using it I can get ...
- 5
3
votes
1
answer
911
views
Sending a reverse shell command through the drupalgeddon vulnerability isn't working
I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine.
the requests:
-curl -k -s 'http://192.168.204.141/?q=...
