Questions tagged [disclosure]

releasing information about security issues to the general public or a selected group.

Filter by
Sorted by
Tagged with
20 votes
4 answers
5k views

Is a responsible disclosure for hardware-based vulnerabilities even possible?

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might ...
dudekowsky's user avatar
1 vote
0 answers
80 views

How to inform the owner of a site about a vulnerability if there is no feedback form? [closed]

Recently, I noticed several resources that may be in danger, but I did not find a feedback form or email or another way to contact the owner and warn. How can I notify the owners? DoS seems to me a ...
dorianw91's user avatar
-1 votes
1 answer
1k views

I found a way to remove controls on a school Chromebook. How should I tell the school? [duplicate]

Our school uses LanSchool Air and content keeper. I found a way to disable both. I have already gotten my Chromebook taken away for "abusing Chromebook privileges" I think this is a major ...
ANON10104's user avatar
40 votes
6 answers
10k views

Software vendor refuses to fix security vulnerability - what to do?

I work as a consultant for a large corporation that uses some software, in which I have found a security vulnerability. I notified both my client and the software vendor about a year ago. They ...
TravelingFox's user avatar
4 votes
1 answer
296 views

A company is still leaking highly sensitive data well over 90 days after I have reported the issue, where to go from here?

Back in February, well over 90 days ago, I reported a vulnerability to a service that is leaking highly sensitive data, such as passport id, full name, date of birth and medical data. After that I ...
Jespertheend's user avatar
4 votes
2 answers
2k views

Acceptably resolving a serious vulnerability disclosure

Hypothetical scenario: An organisation with users who rely on the service's zero knowledge cryptography has a vulnerability disclosure made to it from a research institution. There are multiple ...
Ali's user avatar
  • 61
7 votes
2 answers
1k views

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE. We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
E235's user avatar
  • 173
3 votes
2 answers
213 views

Found a bug in a software product used by the pentesting customer; Who to report it to?

Let's say I'm doing a pentest on BlueCorp and find a bug in the software UnrealSec made and distributed by SecCorp which is used by BlueCorp and found during said pentest. Should I report this bug to ...
ChocolateOverflow's user avatar
40 votes
4 answers
7k views

How do open-source projects prevent disclosing a bug while fixing it?

I understand that many open-source projects request vulnerabilities not to be disclosed on their public bug tracker but rather by privately contacting the project's security team, to prevent ...
Heinzi's user avatar
  • 3,078
0 votes
1 answer
102 views

Course of actions after finding security flaw [duplicate]

I've found what I believe is a significant security flaw on quite a big platform. It can be exploited to obtain on the orders of millions of email addresses with some additional data. They're big ...
reveance's user avatar
72 votes
7 answers
18k views

How do I inform a company I found a leaked database of theirs on the Internet? [duplicate]

Recently I found a leaked database of a company and I do not know how to go about contacting the company. It is so weird because I cannot find any type of Information Security contact email to report ...
Arkest Must's user avatar
0 votes
2 answers
1k views

How do I sell critical vulnerability info to private company? [closed]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
Titan's user avatar
  • 117
-1 votes
1 answer
131 views

I found an XSS site while searching [duplicate]

I found a site where XSS is running I want to report this site because it is dangerous for others Where should I report it?
su3158's user avatar
  • 103
1 vote
0 answers
202 views

Should I report a severe data leak on a site?

I noticed a severe data leak on a Chinese website allowing me to access other users' phone numbers, addresses and names. Should I report this? I don't want the higher management at the company to ...
James Nixon's user avatar
0 votes
1 answer
105 views

Where to disclose heuristic bypass

There's one software, let's call it an anti-malware, that uses a heuristic to detect some types of attack. However there's a very simple to stay under its radar. Where may I report that kind of "...
user1532080's user avatar
55 votes
3 answers
8k views

Where to disclose a zero day vulnerability [duplicate]

We discovered a vulnerability in wide range of Ricoh printers, where with a simple PostScript file sent directly, it is possible to crash the device. To recover you need physical access to the ...
Matteo's user avatar
  • 682
5 votes
1 answer
167 views

Misconfiguration security vulnerability disclosure [duplicate]

I accidently discovered a misconfiguration (?) security vulnerability: Workstation managing system is publicly exposed with default credentials. admin/admin The system contains arround 2k ...
user2917823's user avatar
0 votes
1 answer
401 views

How to disclose an open S3 bucket?

What is the most responsible way of disclosing an open AWS S3 bucket? Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
octothorpe_not_hashtag's user avatar
5 votes
1 answer
549 views

Is it bad practice to remove a resolved report from Open Bug Bounty archive? [closed]

An XSS vulnerability report was made via Open Bug Bounty, which was fixed, confirmed and a reward was made. The reporter has marked the issue was resolved. They have further offered to remove the ...
Joe's user avatar
  • 1,284
0 votes
0 answers
33 views

How to disclose school vulnerability as student [duplicate]

Let’s just say I’m in high school. If I were to of found a way to access all of the schools finals, mid terms, home work assignments, school ids (tied to names), passwords, grades of finals for every ...
Cody's user avatar
  • 1
3 votes
2 answers
316 views

Reporting vulnerability to New York Times

I have successfully discovered a vulnerability in the New York Times website. Is there any known way I can report this? I have not attacked it. But I found a bypass. What should I do?
user avatar
2 votes
1 answer
259 views

How to properly disclose a security vulnerability anonymously?

Let's say I found a login-bypass/root-backdoor in a software my company uses that gives you root privileges within that software by simply entering a keyboard combination. I've reported this within ...
architekt's user avatar
  • 996
5 votes
3 answers
310 views

Avoiding the race condition between time of release and time of update

There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
reed's user avatar
  • 15.8k
83 votes
5 answers
23k views

How to proceed with a white-hat hacker claiming a vulnerability?

I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member. They were reporting on our website being indexed by googlebot (metadata, thin ...
Vcode's user avatar
  • 866
1 vote
1 answer
452 views

Id token contains sensitive information sent by the GET method

I've found that my website is using id_token and it contains user's information. One of that is my phone number which I think it could be a sensitive information. Because, if the attackers are able to ...
Ender's user avatar
  • 111
13 votes
2 answers
723 views

How to deal with responsible disclosure "catch and kill"

My coworkers and I discovered a significant security issue in a popular cybersecurity tool, which shall go unnamed here for reasons that will become obvious. We reported the issue to the tool's ...
Jonathan Kamens's user avatar
2 votes
2 answers
390 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
Amanda Ellaway's user avatar
20 votes
4 answers
3k views

My old job has massive security exploits in their product, but they dont care [duplicate]

A company I used to work for developed a Point Of Sale system that also has an eCommerce portion. While working there, I discovered massive flaws with their security model. Simply put, there is 0 ...
ItsNotMe's user avatar
  • 311
2 votes
1 answer
220 views

How long to wait before publishing a web vulnerability?

I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several ...
F. Iván's user avatar
  • 121
1 vote
1 answer
168 views

Where can I report a program to be reviewed for security vulnerabilities and privacy issues?

After looking for software to store information, I found a program that caught my attention instantly. I purchased a license but after a while, I realized that the program had a big vulnerability. On ...
MarianoM's user avatar
  • 125
3 votes
3 answers
269 views

How should we implement responsible discovery program internally only for our organization employees?

We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about ...
Filipon's user avatar
  • 1,264
1 vote
1 answer
592 views

What are good, safe, not necessarily anonymous ways to disclose vulnerabilities?

Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be ...
bers's user avatar
  • 240
5 votes
1 answer
2k views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
jakes's user avatar
  • 65
1 vote
1 answer
4k views

What is the risk of private IP address disclosure if it is the user IP?

I am checking a web application with OWASP Zed Attack Proxy (ZAP). There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP,...
samphone's user avatar
0 votes
0 answers
148 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
reed's user avatar
  • 15.8k
2 votes
0 answers
136 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
Jim Baize's user avatar
8 votes
1 answer
475 views

How to be taken seriously when doing responsible disclosure?

Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input ...
toom's user avatar
  • 584
5 votes
1 answer
235 views

Categorizing a data leak which is intentionally / by carelessness / by design

I have found a publicly accessible web page which discloses person-related data when queried with matching input data. This is against the company's own data protection promise. I want to report ...
Marcel's user avatar
  • 4,086
11 votes
1 answer
620 views

How to report a vulnerability in a site that wants to call the FBI?

I was browsing a site recently that looked like it had been designed in 2000. However, this site has a good Alexa rank and a fairly active online community. For the protection of the site, I will not ...
user175564's user avatar
4 votes
1 answer
235 views

How to responsibly disclose a vulnerability in a widespread algorithm?

Just to be clear, this is purely hypothetical. Yesterday I got hit in the head with some bricks and, in the haze of concussions, discovered a perfect preimage attack on SHA2. For any given hash, I ...
Hovercouch's user avatar
3 votes
3 answers
286 views

Multiple Passwords Appear to Log Into Single Account on Major Website

I have a single account for a very popular website. I noticed that certain variations of my set password will successfully log me in. I have tested the variations on 3 separate browsers and all have ...
thechimp's user avatar
  • 133
9 votes
2 answers
461 views

How to report a security vulnerability involving multiple unrelated companies?

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products. All those issues aren't security ...
Benoit Esnard's user avatar
1 vote
2 answers
225 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...
Mortada Jafar's user avatar
5 votes
1 answer
525 views

Why were Meltdown and Spectre disclosed at the same time?

Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9). Since their public reveal, there has been some confusion ...
Stevoisiak's user avatar
  • 1,535
5 votes
2 answers
631 views

Why and where was Meltdown made public before schedule for the first time?

Originally, Meltdown and Spectre had a coordinated disclosure date of January 9, 2018. Some vendors were preparing to release fixes at that time, and were caught by surprise when the vulnaribilities ...
Zoltan's user avatar
  • 284
7 votes
1 answer
407 views

Is there a documented process for official information release for embargoed vulnerabilities in the CVE system?

Is there a documented process for official information release for embargoed vulnerabilities in the Common Vulnerabilities and Exposures (CVE) system? If such a process exists, how does it address ...
Parker's user avatar
  • 400
40 votes
4 answers
11k views

Is demanding a "donation" before disclosing vulnerabilities black hat behavior? [closed]

We have been contacted by an "independent security researcher" through the Open Bug Bounty project. First communications were quite OK, and he disclosed the vulnerability found. We patched the hole ...
Jacco's user avatar
  • 7,662
3 votes
0 answers
73 views

What would be the responsible way of disclosing this “exploit”? [duplicate]

I was reverse engineering our school's commercial grading system backend with chrome dev tools observing the GET requests. My intent was to code a nice app, just for me to learn more about this etc. ...
user3051640's user avatar
3 votes
2 answers
290 views

How do I escalate a security concern of a library when the author doesn't seem to care

There's an open source library that is horribly insecure. The author acknowledges it's insecure. The library's headline says "This is an implementation for platform X of Library Y". Library Y is ...
gman's user avatar
  • 458
8 votes
1 answer
269 views

Should I follow up on vulnerabilities that were disclosed over a year ago but have not been fixed?

Background: A few years ago, I asked this question about disclosing somewhat serious vulnerabilities found in my high school's computer network. More than two years later, the principal was made ...
Anonymous's user avatar