Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disclosure]

releasing information about security issues to the general public or a selected group.

72
votes
5answers
15k views

How to proceed with a white-hat hacker claiming a vulnerability?

I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member. They were reporting on our website being indexed by googlebot (metadata, thin ...
1
vote
1answer
43 views

Id token contains sensitive information sent by the GET method

I've found that my website is using id_token and it contains user's information. One of that is my phone number which I think it could be a sensitive information. Because, if the attackers are able to ...
11
votes
2answers
294 views

How to deal with responsible disclosure “catch and kill”

My coworkers and I discovered a significant security issue in a popular cybersecurity tool, which shall go unnamed here for reasons that will become obvious. We reported the issue to the tool's ...
1
vote
2answers
134 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
21
votes
4answers
3k views

My old job has massive security exploits in their product, but they dont care [duplicate]

A company I used to work for developed a Point Of Sale system that also has an eCommerce portion. While working there, I discovered massive flaws with their security model. Simply put, there is 0 ...
2
votes
1answer
112 views

How long to wait before publishing a web vulnerability?

I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several ...
1
vote
1answer
113 views

Where can I report a program to be reviewed for security vulnerabilities and privacy issues?

After looking for software to store information, I found a program that caught my attention instantly. I purchased a license but after a while, I realized that the program had a big vulnerability. On ...
3
votes
3answers
213 views

How should we implement responsible discovery program internally only for our organization employees?

We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about ...
1
vote
1answer
182 views

What are good, safe, not necessarily anonymous ways to disclose vulnerabilities?

Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be ...
1
vote
1answer
234 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
0
votes
1answer
557 views

What is the risk of private IP address disclosure if it is the user IP?

I am checking a web application with OWASP Zed Attack Proxy (ZAP). There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP,...
0
votes
0answers
70 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
2
votes
0answers
80 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
7
votes
1answer
158 views

How to be taken seriously when doing responsible disclosure?

Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input ...
5
votes
1answer
145 views

Categorizing a data leak which is intentionally / by carelessness / by design

I have found a publicly accessible web page which discloses person-related data when queried with matching input data. This is against the company's own data protection promise. I want to report ...
11
votes
1answer
355 views

How to report a vulnerability in a site that wants to call the FBI?

I was browsing a site recently that looked like it had been designed in 2000. However, this site has a good Alexa rank and a fairly active online community. For the protection of the site, I will not ...
4
votes
1answer
112 views

How to responsibly disclose a vulnerability in a widespread algorithm?

Just to be clear, this is purely hypothetical. Yesterday I got hit in the head with some bricks and, in the haze of concussions, discovered a perfect preimage attack on SHA2. For any given hash, I ...
3
votes
3answers
191 views

Multiple Passwords Appear to Log Into Single Account on Major Website

I have a single account for a very popular website. I noticed that certain variations of my set password will successfully log me in. I have tested the variations on 3 separate browsers and all have ...
8
votes
2answers
265 views

How to report a security vulnerability involving multiple unrelated companies?

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products. All those issues aren't security ...
1
vote
2answers
126 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...
5
votes
1answer
427 views

Why were Meltdown and Spectre disclosed at the same time?

Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9). Since their public reveal, there has been some confusion ...
4
votes
2answers
424 views

Why and where was Meltdown made public before schedule for the first time?

Originally, Meltdown and Spectre had a coordinated disclosure date of January 9, 2018. Some vendors were preparing to release fixes at that time, and were caught by surprise when the vulnaribilities ...
8
votes
1answer
246 views

Is there a documented process for official information release for embargoed vulnerabilities in the CVE system?

Is there a documented process for official information release for embargoed vulnerabilities in the Common Vulnerabilities and Exposures (CVE) system? If such a process exists, how does it address ...
0
votes
0answers
14 views

What are the ramifications of reporting a site vulnerablity? [duplicate]

I scanned a site the other day. I found a credit card number. How can I disclose this without anything going wrong for myself? Should I even disclose it?
37
votes
5answers
8k views

Is demanding a “donation” before disclosing vulnerabilities black hat behavior? [closed]

We have been contacted by an "independent security researcher" through the Open Bug Bounty project. First communications were quite OK, and he disclosed the vulnerability found. We patched the hole ...
3
votes
0answers
68 views

What would be the responsible way of disclosing this “exploit”? [duplicate]

I was reverse engineering our school's commercial grading system backend with chrome dev tools observing the GET requests. My intent was to code a nice app, just for me to learn more about this etc. ...
4
votes
2answers
235 views

How do I escalate a security concern of a library when the author doesn't seem to care

There's an open source library that is horribly insecure. The author acknowledges it's insecure. The library's headline says "This is an implementation for platform X of Library Y". Library Y is ...
8
votes
1answer
182 views

Should I follow up on vulnerabilities that were disclosed over a year ago but have not been fixed?

Background: A few years ago, I asked this question about disclosing somewhat serious vulnerabilities found in my high school's computer network. More than two years later, the principal was made ...
1
vote
0answers
72 views

Where to find the latest news in web application security? [closed]

Looking around for recommendations on informative and valuable websites, blogs and/or people to follow to stay up to date on web application security, generally new vulnerabilities disclosures. ...
2
votes
1answer
178 views

Reporting leaked passwords in github repository

I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the ...
0
votes
2answers
435 views

Twitter allows the password to be resolved from a stolen cookie. Is that a problem? [closed]

I recently discovered and reported a security vulnerability to Twitter: Despite my belief that the report it indeed valid, they replied to me with the following response: As far as I can tell, this ...
31
votes
5answers
6k views

How do you tell a website they have expired security certificates?

I often go to more obscure pages on NASA websites, and I have gotten used to running into an expired security certificate now and then. Over the last week, it started coming up a lot more, to the ...
3
votes
2answers
180 views

Contacting customers of vulnerable software, is it wrong?

Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply ...
5
votes
3answers
280 views

Responsible disclosure: company is dedicated to security but doesn't answer

Context: recently I found a vulnerability in a webapp for a big company. They have a full policy on responsible disclosure which I followed to avoid legal issues. The company commits itself to ...
1
vote
0answers
210 views

What can/should I do about gross lack of IT security at another company?

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old ...
2
votes
1answer
101 views

How to proceed if the admin and the responsible CERT do not resolve the issue?

About six months ago, while trying new google dorks, I stumbled upon an open folder containing personal files. To my surprise, google had led me straight to the misconfigured folder of an employee ...
0
votes
0answers
176 views

How to disclose a weak username/password? [duplicate]

I was collecting sites that use a system we're going live with. Just URLs and nothing more, so we can see what others have done with the same system to give us ideas. Since I know how the system ...
9
votes
1answer
237 views

How to legally blog about Windows internals

In the field of malware analysis and reverse engineering, many job postings call for familiarity with the PE file format, Windows internals, etc. However, Microsoft presumably doesn't want people ...
131
votes
10answers
15k views

Should I contact the manufacturer if their product allows access to other users' location information?

I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I'm hiking in the wilderness. While testing out my product, I noticed that the ...
3
votes
2answers
78 views

how are flaws in google chrome usually patched and disclosed

When there is a vulnerability like Flash's in any piece of software such as Chrome, is it disclosed immediately to the general public, or is it kept a secret until it is patched? If the former, are ...
5
votes
1answer
257 views

What are the pros and cons of disclosing a vulnerability before it is patched?

I had heard a lot about Google's project zero and it's 90 day deadline for vulnerability disclosure. It has taken some flak from Microsoft for disclosing the bugs before they were patched. I ...
0
votes
1answer
62 views

Services disclosing private data to a third country

Can I be sure that providers such as google, aws, DO, hetzner, rackspace, etc. won't disclose my private data to a third country like Russia (which resident I am). I started a dialog with AWS support ...
4
votes
1answer
158 views

Site exposes user's GPS location through EXIF data

Recently while lurking around one of the social networking sites popular with local folks, I have found out that the site does not scrub out the GPS data from uploaded pictures. I've contacted them ...
4
votes
1answer
528 views

Login Name and Password in URL

I've recently encountered a webapp, which has it's url in the following format: http://www.[WEBAPP].com/INetService/Show.aspx?Username=[EMAIL]&EncryptedPassword=[Some String of 32 characters ...
-1
votes
1answer
65 views

If multiple people report a security vulnerability which is not fixed, should everybody get the credit or only the first person? [closed]

I reported a vulnerability to an organization X and they claim that they already know about it and are working towards a fix? I am wondering if multiple people report the same vulnerability to an ...
6
votes
1answer
144 views

Publishing an exploit after vendor contact and patching [duplicate]

I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch. I understand this is a very competitive field so I would like to publish ...
4
votes
0answers
186 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...
7
votes
4answers
1k views

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
3
votes
1answer
172 views

Found a security issue but no answer

I found a security issue on a politician personal site about two weeks ago. The site is still very active and has a bunch of visitors every day. The breach is very stupid and I'm probably not the ...
26
votes
4answers
4k views

What to do when I find a possible security vulnerability of public interest? [duplicate]

Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide. I am not an expert in security, but there ...