Questions tagged [cve]
Common Vulnerabilities and Exposures (CVE) is a dictionary to describe known vulnerabilities.
209
questions
0
votes
0
answers
62
views
trying to test the vulnerability CVE 2015-0205 for university project
I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes.
I found this explanation of CVE-2015-0205:
...
0
votes
0
answers
24
views
How could we fix Microsoft LDAP Enforce Channel Binding CVE-2017-8563?
I had a DC server running Microsoft Windows Server 2008 R2 x64. After a vulnerability scan launched on this server using Nexpose, the CVE-2017-8563 was reported by the vulnerability scanner with the ...
- 1
1
vote
0
answers
41
views
Should vendors add their CPEs in the log4j NIST entry?
Software that has packaged a vulnerable version of the log4j library is considered vulnerable to CVE-2021-44228 or "log4shell". When I look at the NIST definition I can see that the ...
- 181
0
votes
0
answers
803
views
Logback's CVE-2021-42550 - Is this really a vulnerability?
I'm really struggeling with understanding CVE-2021-42550. Logback says:
A successul RCE attack with CVE-2021-42550 requires all of the following conditions to be met:
write access to logback.xml
use ...
- 11
1
vote
1
answer
73
views
How can I be alerted for security breach, bulletin, CVE for a list of manufacturers
I'm trying to find a solution to be able to be alerted of security alerts for a list of software, hardware that we are using.
I've found https://www.secalerts.co, which looks good, but it seems that ...
- 13
0
votes
0
answers
49
views
Atomikos dependency and CVE-2021-44228
In regard to the recent CVE-2021-44228 vulnerability, I've noticed that even the newest version of atomikos-util 5.0.8 is using a vulnerable version of Log4J 2.2 - as an internal dependency..
I was ...
- 243
0
votes
0
answers
53
views
How dangerous is a leaked private key from outside the infrastructure in context of: "Azure Active Directory keyCredential property Disclosure?"
Microsoft published the Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs which describes how to check if an Azure AD is ...
- 101
10
votes
2
answers
2k
views
Does CVE-2021-42694 affect only compiled code?
A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0.
Does it only affect code compiled from sources with disallowed unicode characters?
RHEL ...
- 1,457
-1
votes
1
answer
131
views
Ubuntu CVE Score - Gained acces level:None - Does it mean personal data is safe on ubuntu?
I was studying the following page listing all the vulnerabilities of ubuntu. CVE Ubuntu
What I found surprising is that all vulnerabilities report that "gained access level: None". Does that ...
- 101
1
vote
0
answers
81
views
Check website for deprecated libraries and known CVEs [closed]
I was curious if anyone knew of a tool, website, or browser extension that will tell you if a site has deprecated libraries and if there are CVEs related to that. I currently have burpsuite pro and ...
0
votes
1
answer
132
views
Determining applicability of CVEs without CPEs?
I am trying to build an automated pipeline to trigger certain inhouse-software events when relevant CVEs of products-of-interest are published. I am trying to utilise NIST NVD datafeeds for this ...
- 1
5
votes
2
answers
830
views
Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?
I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE.
We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
- 151
7
votes
1
answer
266
views
What exactly is CVE-2021-23978 (from MSFA2021-08 in Mozilla Firefox)?
A number of vulnerabilities were fixed in Firefox in the latest update. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information:
Mozilla ...
- 64k
4
votes
3
answers
2k
views
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
We cannot remove RPMs or similar.
We can only change a configuration.
Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
- 1,457
0
votes
1
answer
96
views
CVE submission - Denial of Service vs. Remote code execution
I wanted to ask how to deal with a new remote code execution vulnerability that has the same origin as an already found Denial of Service vulnerability? Can I apply for a new CVE ID for this? This is ...
0
votes
0
answers
238
views
Is Microsoft CVE-2020-1045 a credible threat?
Microsoft released CVE-2020-1045 in September 2020.
A security feature bypass vulnerability exists in the way Microsoft
ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser ...
- 181
1
vote
1
answer
71
views
How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?
Let's consider the following code in a hypothetical C library.
uint8_t size;
uint8_t buf[128];
read(untrusted_fd, &size, 1);
read(untrusted_fd, buf, size);
In the early 2000s, it would be a ...
- 113
4
votes
2
answers
304
views
Why CVSS range 8 to 9 is almost inexistent
According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range.
Even compared to the low score ranges ...
- 562
1
vote
1
answer
96
views
CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?
I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
- 3,502
2
votes
1
answer
96
views
Which CVE Numbering Authority (CNA) should I contact for a vulnerability found in the GNU Scientific Library?
I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it.
According to the procedure explained here: https://cve....
- 125
4
votes
1
answer
937
views
What is the Plundervolt attack?
CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack.
What is the Plundervolt attack?
Should domestic users be afraid of ...
- 143
-1
votes
1
answer
186
views
Google says CVE-2020-15999 was for a zero day exploit found on 2020-10-19, but the CVE record was created on 2020-07-27. What am I missing?
There have been numerous reports in the last week about the Chrome exploit using a bug in the FreeType library. According to reports, this bug was found on 2020-10-19.
https://chromereleases....
3
votes
1
answer
451
views
Is disabling IPv6 an effective workaround for "Bad Neighbor" Vulnerability (CVE-2020-16898)?
CVE-2020-16898 is a remote code execution vulnerability caused by the improper handling of ICMPv6 Router Advertisement packets by Windows TCP/IP stack. Microsoft's recommended workaround is to disable ...
3
votes
1
answer
3k
views
WireGuard / CVE-2019-14899: How secure the protocol really is?
I've been using OpenVPN and SSH tunnels for a multitude of scenarios over the years and recently I've been earning a lot of buzz around the simplicity and security of WireGuard. Now I've found some ...
- 217
3
votes
3
answers
191
views
Applicability of CVE-2018-14721
My project uses different versions of jackson library at a number of places, and a security scanner flagged that the binary is vulnerable to CVE-2018-14721. My reading of https://nvd.nist.gov/vuln/...
0
votes
2
answers
746
views
How can I map CVEs to their underlying CWE?
I was tasked with developing a consistent, relatively complete map for CVEs to CWEs at my internship, and I'm kind of at a loss finding a method to find a 1-to-1 way to map CVEs onto CWEs. Ideally, ...
0
votes
1
answer
197
views
How to find dates of a CVE?
Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?
- 11
1
vote
1
answer
133
views
Does the DICOM file header gets lost when transferred over the network?
I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
1
vote
0
answers
144
views
Exploit CVE-2020-0688 for older versions
I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised.
The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
- 11
0
votes
0
answers
273
views
Vulnerable Apache Tomcat server
I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617.
Any Apache Tomcat ...
0
votes
0
answers
129
views
Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?
My team and I have written a web app, and we had a bug report regarding a DoS vulnerability.
This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
- 1
0
votes
1
answer
320
views
CVE fields vulnerable_products vs whats in configuration
I would like to understand better the structure of the CVE.
(For example) in CVE-2018-19081, vulnerable_products mention product Opticam i5. like so:
"vulnerable_products": [
"cpe:2.3:o:...
- 53
-4
votes
1
answer
240
views
I found a security vulnerability in a web app developed by my university. Can it have a CVE number?
I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.
Using it I can get ...
- 5
3
votes
1
answer
757
views
Sending a reverse shell command through the drupalgeddon vulnerability isn't working
I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine.
the requests:
-curl -k -s 'http://192.168.204.141/?q=...
1
vote
0
answers
91
views
How do I sort a large number of security vulnerabilities (CVEs) by severity? [closed]
During the course of my work, I was enumerating about 14 IPs and now my next task is manual checking each of the 500+ CVEs I found. I would like to sort them by severity and automate this as much as ...
- 11
0
votes
0
answers
181
views
Telerik cve only find key?
I found that a website is using a version of telerik web ui that may be vulnerable to cve-2017-9248.
However when i use the python script with command
`python script.py -k https://www.website.com/...
- 19
0
votes
0
answers
106
views
How to remediate a CVE or find a work around before the patch is released?
I was going through set of security vulnerabilities reported in Oracle Critical Patch Update. I want to find out the standard process followed by developers/security people to mitigate these kind of ...
- 101
0
votes
0
answers
1k
views
Is there a way to map each CVE to a technique/tactic in the mitre ATT&CK matrix?
The only 'solution' I thought of is linking a CVE to a CWE and then to a CAPEC (Method found in this link: How to find CAPEC items related to a CVE) but I am unable to get from a CAPEC attack pattern ...
- 1
10
votes
1
answer
339
views
How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?
What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
- 7,333
5
votes
2
answers
2k
views
Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?
I'm getting conflicting reports.
Search in Google: "windows 7" fix CVE-2020-0601
The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7".
Scrolling down ...
- 420
0
votes
1
answer
291
views
Difference between CVE and OSVDB?
Can someone explain the differences between a CVE and an OSVDB identifier?
Both seem to serve the purpose of uniquely identifying a vulnerability or an expose, however not every OSVDB entry also has a ...
- 165
0
votes
0
answers
117
views
Exploitation differences between Docker and VirtualBox for CVE-2010-4221
I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability.
I ...
- 165
2
votes
0
answers
125
views
Are there any JRE/JDK exploits that do not require the presence of applets or plugins?
For triggering a Java exploit should applets be enabled in the user's machine?
That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
- 2,099
0
votes
2
answers
151
views
How Vulnerability scanners assign CVE codes to Vulnerability found
I just want to know how CVE codes are assigned by the vulnerability scanners, while it found the particular vulnerability.
1
vote
0
answers
118
views
Why does CVE-2019-2130 show up in Ubuntu and NodeJS?
In the NVD report for CVE-2019-2130 it shows that the products that are affected are only Android, and the links found in the Mitre page of the CVE lead only to an Android report of the CVE.
This is ...
- 111
1
vote
2
answers
290
views
Can I trust that the Java CVE's contain only the affected versions?
When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description.
However, I'm not confident that ...
- 13
1
vote
3
answers
1k
views
How to scan a list of RPM files for publicly declared (CVE) vulnerabilities?
Couldn't find a reliable tool to scan a list of CentOS or RHEL RPM files for vulnerabilities (e.g. list CVEs found for each file).
The goal is to scan the RPM files for vulnerabilities before they ...
- 444
4
votes
1
answer
747
views
Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?
Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
- 41
6
votes
2
answers
280
views
Can A chain of exploits count as a CVE?
If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits),
but when used together in an exploit chain can achieve a meaningful ...
- 85
2
votes
1
answer
262
views
What does "Obtaining a CVE" mean
I've have seen the term around and I mostly get that it is referred to when someone reports a vulnerability to Mitre.
But what does this mean practically? Are you listed somewhere as the reporter? ...
- 290