Questions tagged [cve]
Common Vulnerabilities and Exposures (CVE) is a dictionary to describe known vulnerabilities.
187
questions
0
votes
2answers
41 views
How can I map CVEs to their underlying CWE?
I was tasked with developing a consistent, relatively complete map for CVEs to CWEs at my internship, and I'm kind of at a loss finding a method to find a 1-to-1 way to map CVEs onto CWEs. Ideally, ...
0
votes
1answer
47 views
How to find dates of a CVE?
Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?
1
vote
1answer
92 views
Does the DICOM file header gets lost when transferred over the network?
I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
1
vote
0answers
60 views
Exploit CVE-2020-0688 for older versions
I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised.
The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
0
votes
0answers
43 views
Vulnerable Apache Tomcat server
I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617.
Any Apache Tomcat ...
0
votes
0answers
91 views
Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?
My team and I have written a web app, and we had a bug report regarding a DoS vulnerability.
This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
0
votes
1answer
120 views
CVE fields vulnerable_products vs whats in configuration
I would like to understand better the structure of the CVE.
(For example) in CVE-2018-19081, vulnerable_products mention product Opticam i5. like so:
"vulnerable_products": [
"cpe:2.3:o:...
-3
votes
1answer
167 views
I found a security vulnerability in a web app developed by my university. Can it have a CVE number?
I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University.
Using it I can get ...
2
votes
1answer
84 views
Sending a reverse shell command through the drupalgeddon vulnerability isn't working
I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine.
the requests:
-curl -k -s 'http://192.168.204.141/?q=...
1
vote
0answers
36 views
How do I sort a large number of security vulnerabilities (CVEs) by severity? [closed]
During the course of my work, I was enumerating about 14 IPs and now my next task is manual checking each of the 500+ CVEs I found. I would like to sort them by severity and automate this as much as ...
0
votes
0answers
87 views
Telerik cve only find key?
I found that a website is using a version of telerik web ui that may be vulnerable to cve-2017-9248.
However when i use the python script with command
`python script.py -k https://www.website.com/...
0
votes
0answers
49 views
How to remediate a CVE or find a work around before the patch is released?
I was going through set of security vulnerabilities reported in Oracle Critical Patch Update. I want to find out the standard process followed by developers/security people to mitigate these kind of ...
0
votes
0answers
250 views
Is there a way to map each CVE to a technique/tactic in the mitre ATT&CK matrix?
The only 'solution' I thought of is linking a CVE to a CWE and then to a CAPEC (Method found in this link: How to find CAPEC items related to a CVE) but I am unable to get from a CAPEC attack pattern ...
10
votes
1answer
273 views
How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?
What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
4
votes
2answers
2k views
Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?
I'm getting conflicting reports.
Search in Google: "windows 7" fix CVE-2020-0601
The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7".
Scrolling down ...
0
votes
1answer
59 views
Difference between CVE and OSVDB?
Can someone explain the differences between a CVE and an OSVDB identifier?
Both seem to serve the purpose of uniquely identifying a vulnerability or an expose, however not every OSVDB entry also has a ...
0
votes
0answers
28 views
Find which image has CVE package fixes
I have a handful of google container images that are flagging musl vulns.
Example:
gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.13
https://console.cloud.google.com/gcr/images/google-...
0
votes
0answers
50 views
Exploitation differences between Docker and VirtualBox for CVE-2010-4221
I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability.
I ...
2
votes
0answers
66 views
Are there any JRE/JDK exploits that do not require the presence of applets or plugins?
For triggering a Java exploit should applets be enabled in the user's machine?
That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
0
votes
2answers
95 views
How Vulnerability scanners assign CVE codes to Vulnerability found
I just want to know how CVE codes are assigned by the vulnerability scanners, while it found the particular vulnerability.
0
votes
0answers
42 views
Telerik Script not working correctly?
I found that a website is using a version of telerik web ui that may be vulnerable to cve-2017-9248.
However when i use the python script with command
python script.py -k https://www.website.com/...
1
vote
0answers
74 views
Why does CVE-2019-2130 show up in Ubuntu and NodeJS?
In the NVD report for CVE-2019-2130 it shows that the products that are affected are only Android, and the links found in the Mitre page of the CVE lead only to an Android report of the CVE.
This is ...
1
vote
2answers
117 views
Can I trust that the Java CVE's contain only the affected versions?
When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description.
However, I'm not confident that ...
0
votes
0answers
39 views
Security bug in wildfly-security-manager
I have a question to this Common Vulnerabilities and Exposures about wildfly-security-manager: CVE-2019-14843
Does this security flaw imply an attacker could break into the wildfly server, or does it ...
0
votes
3answers
335 views
How to scan a list of RPM files for publicly declared (CVE) vulnerabilities?
Couldn't find a reliable tool to scan a list of CentOS or RHEL RPM files for vulnerabilities (e.g. list CVEs found for each file).
The goal is to scan the RPM files for vulnerabilities before they ...
1
vote
1answer
267 views
Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?
Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
6
votes
2answers
206 views
Can A chain of exploits count as a CVE?
If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits),
but when used together in an exploit chain can achieve a meaningful ...
1
vote
1answer
118 views
What does “Obtaining a CVE” mean
I've have seen the term around and I mostly get that it is referred to when someone reports a vulnerability to Mitre.
But what does this mean practically? Are you listed somewhere as the reporter? ...
0
votes
1answer
223 views
Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation?
I found an interesting blog post A Deep Analysis of the Microsoft Outlook Vulnerability CVE-2018-8587 about Microsoft Outlook heap buffer overflow vulnerability where is described how Microsoft ...
3
votes
1answer
199 views
How long it takes to receive CVE-ID from cve.mitre.org?
I had applied for CVE ID at https://cveform.mitre.org/.
I did followed their guidelines, and did exactly as their instructions said (didn't add PGP key as it seems optional). It's been 2 month since ...
3
votes
1answer
1k views
API to Get CVE Info [closed]
I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
1
vote
0answers
63 views
CVE vulnerable apps repository [closed]
According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists?
Exploit-DB offers vulnerable apps, i.e. for:
https://www.exploit-db.com/exploits/46962
it is ...
0
votes
1answer
1k views
Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6
How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
1
vote
1answer
563 views
nvd json database without vendor and product info
I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED
I see many entries, where vendor product information is not filled in (cve->affects->...
3
votes
1answer
112 views
How to request CVE if CNA didn't provide an answer
A couple of weeks ago I have found a vulnerability in a product. I have contacted them reporting it a week ago and also to get the CVE.
I didn't receive any answer from the mailing list and I would ...
57
votes
6answers
8k views
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
2
votes
2answers
3k views
How do the CVE-2018-10562 and CVE-2018-10561 exploits work?
https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
Firstly, the use of 'GPON' I find misleading because this vulnerability is to do with the routers and webservers and not the access ...
0
votes
1answer
65 views
Is CVE2012-5373 fixed in OpenJDK7?
Can anyone please tell me if CVE2012-5373 is fixed in OpenJDK7? I have searched for the fix details, but I couldn't find any.
9
votes
1answer
276 views
What is the reason for the increase of CVEs since 2017?
According to CVEdetails.com, there were 6447 CVEs in 2016.
In 2017 there were 14714 CVEs. That's 128% more than in 2016.
Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
126 views
Can a CVE be removed from NVD database?
Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or ...
1
vote
2answers
125 views
Risk and probability from CVE
How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14),
The cost is derived from the attack tree, and risk and probability are
based on CVE
...
1
vote
1answer
162 views
Exploit database for NVD vulnerabilities [closed]
I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
0
votes
2answers
64 views
Can Netsparker detect a CVE in an open source library packaged in a WebPack bundle?
In a recent Netsparker scan, a CVE against an open source JavaScript library was reported (as expected). I'm trying to understand exactly how Netsparker determines:
1. Which JS library is being used,...
2
votes
1answer
58 views
Given a list of components and versions, how can I check if any of them have known vulnerabilities?
In this case, I have a list of names and versions, but not access to any source code or binaries. E.g.
ComponentA 2.6.6
ComponentB 1.1
ComponentC 0.12
The list is more than 300 components long, so ...
2
votes
2answers
85 views
Microsoft Windows CVEs?
I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
1
vote
1answer
2k views
What would be the impact of a CVE-2015-9251 vulnerability?
I've seen that in jQuery versions older than jQuery 3 there is the CVE-2015-9251 vulnerability which can result in cross-site scripting. Is this a limited vulnerability? What could be its possible ...
0
votes
0answers
46 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
2
votes
1answer
1k views
What *actually* is a Java applets vulnerability?
When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component?
what exactly is exploited?
2
votes
2answers
1k views
How to discover known vulnerabilities (CVEs) in Go executables? [closed]
Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.
Would it be possible to do ...
0
votes
2answers
1k views
SambaCry CVE-2017-7494 returns “Exploit completed, but no session was created”
I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows:
Module options (exploit/linux/samba/sambacry)
Payload options (linux/x64/meterpreter/reverse_tcp)
...
