Questions tagged [information-exposure]
The information-exposure tag has no usage guidance.
16
questions
0
votes
2
answers
55
views
What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?
I encountered an open TCP/143 IMAP port which responded with this banner:
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=...
- 6,651
0
votes
1
answer
81
views
Should bounties be paid for information exposure?
An ethical hacker found that a system I own, has an exposure of information. They were able to determine the programming language, a web framework and the exact versions of both from a stack trace by ...
- 101
1
vote
0
answers
86
views
I have found my email online in a .txt file. What should be my next steps? [closed]
A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
- 11
0
votes
1
answer
392
views
Is having hard-coded API keys such as the SafetyNet API key considered a vulnerability?
I have a scenario where the developers are using SafetyNet API to protect their Android apps. I observed that the SafetyNet API key has been hard-coded within the apk file. This is the first time I ...
0
votes
1
answer
81
views
I gave my first name and alt email to someone I don't know, will that reveal who I am?
So, I wanted to get this game (to try it as it had no demo), so I went to a website, did not click on anything except the link to the Google drive folder, and then stupidly requested access to a ...
user281008
22
votes
6
answers
5k
views
Backend database username and password revealed in JSP Page
Recently I came across a website and when clicking on one of hyperlinks it displayed a HTTP 500 error page as shown in the image, which indicated that it is using Java Server Pages and on line 23 the ...
- 322
3
votes
3
answers
637
views
HttpResponse Headers Information Leakage on Server Error (Verbose Headers)
In the past I have dealt with security issues related to Default Service Banners/Verbose Headers/Information Leakage via HttpResponse Headers. These issues are quite common, and usually look ...
- 171
3
votes
1
answer
394
views
Cookies VS localStorage (JavaScript Security)
I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
- 269
2
votes
1
answer
1k
views
Which information is disclosed to a merchant when paying online with a credit card?
Several sites require me to input far too many personal details in order to register. This now includes phone numbers, which they have zero legitimate uses for - they are never used after the initial ...
- 21
32
votes
3
answers
8k
views
Is it safe to share .git folder of a public repo?
Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private ...
- 603
0
votes
1
answer
87
views
How do mobile apps share details with each other to show customized ads
My question is more towards how this is implemented. I mean do they expose apis to each other or store data at a common place to be accessed by others. Please excuse me if it seems too naive.
- 1,325
7
votes
1
answer
870
views
Does WhatsApp's link preview on the link messages leak information?
When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below:
Does this leak information ...
- 5,519
2
votes
2
answers
167
views
Getting real machine information from a virtual machine
If a malicious software gets into a virtual machine, what is the most information of the actual machine it can obtain?
- 123
3
votes
0
answers
207
views
What is the Meow Attack and how can I guard my databases against it?
Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
- 968
1
vote
1
answer
90
views
Autofilling sensitive information for publicly available form
We are in the process of designing an app which, simply put, will allow people to accept payments easily.
The customer won't need an account and we'll be linking customer data (name, address, and ...
- 227
0
votes
0
answers
224
views
Does Asp.Net Core exposes too much information for required enums that were not supplied?
I have a simple code for an input model:
public class MyClass
{
[Required]
public MyEnum? Type { get; set; }
}
Now if I do not send Type as a part of json to the request, I get this error ...
- 2,267