Questions tagged [known-vulnerabilities]

A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

Filter by
Sorted by
Tagged with
0
votes
0answers
73 views

How to protect an unsupported OS that I am forced to use?

There are some reasons that many old versions of different OS's are in use, (Free BSD, Solaris, Linux, Unix, Windows Server, Windows workstation, DOS, ...). Sometimes we had to use that old operation ...
0
votes
0answers
44 views

How would you investigate if CoronaBlue has been exploited by an attacker or not?

How would you investigate if CVE-2020-0796 (Windows SMBv3 Client/Server Remote Code Execution Vulnerability) has been exploited by an attacker or not?
1
vote
0answers
43 views

What should we do in practice to mitigate vulnerabilities in WPA3?

WPA3 for Wi-Fi systems is generally acknowledged to be more secure than WPA2. For example, it introduces SAE with the Dragonfly handshake, in an attempt to close the door on the kind of brute force ...
0
votes
0answers
61 views

How to determine if particular .NET/ASP.NET build has known vulnerabilities?

I'm trying to find a list to help find out if particular ASP.NET version has known vulnerabilities by version-build number. Googling doesn't help. Is there a list by Microsoft that can help me, ...
0
votes
0answers
76 views

Does iOS 13.4.1 fix the VPN vulnerability?

It was found by ProtonVPN that there is a vulnerability in previous versions of iOS which causes internet connections not reestablished under the VPN tunnel: https://protonvpn.com/blog/apple-ios-...
-2
votes
1answer
84 views

Upgrading Software Version: risk of an unknown vs known vulnerabilities

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software? For example, with every software ...
0
votes
0answers
24 views

What are the vulnerabilities of the autofill feature in iOS 11 and later?

iOS 11, 12, and later offer an autofill function from the iOS keyboard for specific apps enabled for the function. I have read Apple's documentation and it appears that the passwords are stored in the ...
1
vote
1answer
279 views

Remotely exploit Linux kernel with CVE-2017-18017? [closed]

I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually ...
1
vote
2answers
117 views

Can I trust that the Java CVE's contain only the affected versions?

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that ...
1
vote
2answers
207 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
2
votes
2answers
446 views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
1
vote
1answer
515 views

Is disabling Remote Desktop Services sufficient to protect a Windows device from the BlueKeep vulnerability?

Microsoft (and the NSA) have been urging Windows users and administrators to install patches to protect systems from the BlueKeep (CVE-2019-0708) vulnerability. Is disabling Remote Desktop Services ...
1
vote
0answers
60 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
0
votes
1answer
1k views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
57
votes
6answers
8k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
0
votes
1answer
204 views

External hard drive's hardware vulnerabilities [closed]

You have an external hard drive that was left in a public place. The data is encrypted. What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts ...
0
votes
1answer
126 views

Can a CVE be removed from NVD database?

Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or ...
-1
votes
1answer
48 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
1
vote
1answer
42 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
19
votes
2answers
3k views

As an end user, what risk is there in browsing a public website that uses TLSv1?

Is it safe for an end user to browse a website that only supports TLSv1 (or other insecure ciphers or protocols), given the following: it's a publicly accessible website with no sensitive or private ...
1
vote
1answer
381 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
14
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
2
votes
2answers
85 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
2answers
456 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
-2
votes
2answers
397 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
1
vote
1answer
572 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
2
votes
2answers
1k views

How to discover known vulnerabilities (CVEs) in Go executables? [closed]

Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index. Would it be possible to do ...
1
vote
2answers
102 views

How do so many vulnerable IoT devices stay alive and online?

With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online? Suppose I have a device online which can be accessed (as root) ...
2
votes
1answer
198 views

owasp top 10 2017 automation

I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
5
votes
2answers
233 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
0
votes
0answers
88 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
0
votes
1answer
333 views

What is the attack vector for CVE-2018-3639 Speculative Store Bypass?

We use Web Application deployed on a CentOS server. Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server? I cannot understand the attack vector ...
1
vote
3answers
437 views

Test for OWASP Using Components with Known Vulnerabilities?

I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities". If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
3
votes
2answers
5k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
3
votes
1answer
517 views

Are there any known Python pickle viruses?

I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/ The docs are suggesting ...
1
vote
0answers
196 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
36
votes
6answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
1
vote
0answers
60 views

Is my website being checked for vulnerabilities or being attacked? [duplicate]

I have a website running on windows hosting with plesk 11 version and website is based on .net 4.5 by default PHP is also active for this website but is not being used. I have disabled PHP as i am not ...
167
votes
3answers
16k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
7
votes
1answer
270 views

Is there a documented process for official information release for embargoed vulnerabilities in the CVE system?

Is there a documented process for official information release for embargoed vulnerabilities in the Common Vulnerabilities and Exposures (CVE) system? If such a process exists, how does it address ...
1
vote
0answers
142 views

Flash Descriptor write-protection defaults

According to Intel in this article, to exploit Intel SA 00086 an attacker needs physical access if Flash Descriptor write protections are enabled. I assembled my computer myself, and it doesn't look ...
1
vote
2answers
598 views

Checking for hardware vulnerabilities (like Intel Management Engine) semi-automated?

Is there a nice semi-automated way that I would just paste output of my /proc, lspci, or any other hardware description and get suggestions to what kind of vulnerabilities a given computer may be ...
1
vote
0answers
29 views

What can one do to secure holes described by Arnaboldi? [closed]

I have just read: https://www.blackhat.com/docs/eu-17/materials/eu-17-Arnaboldi-Exposing-Hidden-Exploitable-Behaviors-In-Programming-Languages-Using-Differential-Fuzzing-wp.pdf Which describes some ...
3
votes
3answers
998 views

How to get vulnerabilites by product name and version

I have a list of software installed on workstations which contains product name and version, for example my list contains Mysql Workbench 6.3.8. Searching in CVE Details I found out that this software ...
0
votes
1answer
870 views

How to scan PHP code for vulnerable functions? [closed]

I saw a pentest report and there was a section where the pentester list all the functions that are vulnerable in PHP. How did he scan the code and what tools can be used, and is it possible to do it ...
3
votes
3answers
732 views

Checking if a web application uses known vulnerable components

I've been doing research on the OWASP top 10 web application vulnerabilties, one of them is using components with know vulnerabilities. I'm a little confused here, as I don't understand how you could ...
0
votes
3answers
93 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
3
votes
2answers
646 views

How can Draytek products not be affected by KRACK as they claim?

According to Draytek on their website, When DrayTek wireless products, such as wireless routers and access points, are used as wireless base stations, they are not affected by the KRACK (Key ...
1
vote
0answers
72 views

Can a computer be vulnerable to BroadPwn?

There is a lot of info and warnings about most phones using Broadcom BCM43xx WiFi chipset that are vulnerable to remote code execution and full takeover. What about computers? I saw that MacOS also ...
57
votes
3answers
9k views

My Android phone is vulnerable, but there are no updates?

I bought brand new HTC Desire 526G with operating system 4.4.2 (Kitkat), everything is as it should be (not rooted) so it is still on factory settings. But now I didn't get for a long time any ...

1
2 3 4 5
8