Questions tagged [known-vulnerabilities]

A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

Filter by
Sorted by
Tagged with
0 votes
1 answer
61 views

Filter CVEs by affected OS

Is it possible to filter CVEs by affected platform/OS? Some sources do provide this, like exploit-db, but the main vulnerability source NVD, National Vulnerability Database, doesn't seem to have such ...
e-epsojn's user avatar
0 votes
0 answers
74 views

Are there any attacks against TLS 1.1 encryption? [duplicate]

I've been researching the main TLS 1.1 vulnerabilities, and from what I've seen, TLS 1.2 only improves the cryptographic hash functions, because TLS s 1.1 are broken. If these hash functions are ...
P00's user avatar
  • 43
0 votes
0 answers
51 views

Why isn't google patching methods used for MITB by malware like Emotet?

Google Chrome uses CFG, ASLR, DEP, Remote PE blocking, Authenticode API, syscall-disabled, but malware like Emotet is still doing MITB web injects on the latest builds on Chrome(108.0.5359.95). Why ...
TJCoder's user avatar
  • 11
1 vote
0 answers
95 views

Any vulnerability of OCSP for proof of concept

I have an assignment in which I have to implement OCSP and do a proof of concept of a vulnerability. My idea was to implement OCSP without using a nonce (this is done) and then perform a replay attack....
Pedro's user avatar
  • 11
2 votes
1 answer
1k views

Missing Linux Kernel mitigations for 'iTLB multihit' hardware vulnerabilities

I don't know how to mitigate iTLB multihit vulnerability. /sys/devices/system/cpu/vulnerabilities/itlb_multihit | KVM: Vulnerable Found this: iTLB multihit, But i have no access to the host machine ...
Przemon's user avatar
  • 41
0 votes
2 answers
252 views

Where to find detailed info of how to exploit known vulnerabilities?

With most vulnerabilities, I see just summaries and not much detail about what is happening. Is there a good location where you can find demos of CVEs? For example, a CVE would say that the router ...
adrianTNT's user avatar
  • 140
1 vote
2 answers
226 views

File Upload(what type of file)

While I was learning about file upload vulnerability one question come to my mind. What type of file do I use while hunting file upload vulnerability ? Do I need to detect which programming language ...
charlie's user avatar
  • 11
1 vote
1 answer
420 views

How does FTP Bounce work

I am currently doing a project on FTP bounce and after reading up, I still do not really get how it works/can work. Appreciate if I can receive enlightenment from the experts here. I understand that ...
Mervyn Heng's user avatar
0 votes
0 answers
20 views

Are QR codes more dangerous to scan in 2022? [duplicate]

Per this question in 2012, (Security risks of scanning an unknown QR code) there are a few big risks to scanning a QR code: Scanning a URL that links you to a malicious website Scanning a QR code ...
lynn's user avatar
  • 715
0 votes
0 answers
76 views

Implementing a protection for pie register vulnerability

I'm working on implementing a protection for a WordPress pie register plugin vulnerability being called: WordPress pie register 3.7.1.4 auth bypass / RCE I've conducted a research on the pie register ...
Amit Gabay's user avatar
0 votes
2 answers
2k views

Is Xcode vulnerable due to log4j?

After the log4j vulnerability was announced, I scanned my Mac to see if any applications were using it. find / -name "*log4j*" 2>/dev/null Here's the output that indicates that Xcode has ...
tinkerr's user avatar
  • 101
0 votes
1 answer
695 views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
TimothySimon's user avatar
2 votes
1 answer
186 views

Handling indirect vulnerable 3rd party dependencies

How would one go about fixing vulnerabilities in indirect 3rd party libraries? Let's say that the vulnerability is introduced via the following chain: Introduced through: example-app› express-...
MR.Elegant's user avatar
0 votes
2 answers
453 views

Remediating base image vulnerabilities

I'm trying to build a base image that pulls from php:7.3-fpm, which is built on debian:buster-slim. The php:7.3-fpm base image has vulnerabilities out of the box, like https://security-tracker.debian....
dzzl's user avatar
  • 11
1 vote
2 answers
406 views

What is an XML round trip vulnerability?

I keep hearing about the XML round trip vulnerability in version 3.2.4 of the Ruby package REXML. I looked into it myself, of course, and it seems to have something to do with parsing an XML document, ...
Alex V's user avatar
  • 190
0 votes
1 answer
170 views

Can a hacker install known-vulnerable software on a machine in order to control the PC and elude antivirus?

I recently discovered that on one of my PCs the SolarWinds software was installed. I didn't install this software on my machine. I also saw that SolarWinds was cracked by Russian hackers and also ...
Ion Stirba's user avatar
2 votes
0 answers
424 views

As of 2020, is there any fix for 802.11w deadlock?

This is an old 802.11w issue that has been documented and it's a very big issue as clients can be selectively attacked and enter a deadlock, where only disabling and re-enabling wifi solves the issue (...
Motheus's user avatar
  • 121
2 votes
0 answers
332 views

What should we do in practice to mitigate vulnerabilities in WPA3?

WPA3 for Wi-Fi systems is generally acknowledged to be more secure than WPA2. For example, it introduces SAE with the Dragonfly handshake, in an attempt to close the door on the kind of brute force ...
auspicious99's user avatar
-2 votes
1 answer
156 views

Upgrading Software Version: risk of an unknown vs known vulnerabilities

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software? For example, with every software ...
8protons's user avatar
  • 218
1 vote
1 answer
693 views

Remotely exploit Linux kernel with CVE-2017-18017? [closed]

I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually ...
c0mraide's user avatar
1 vote
2 answers
365 views

Can I trust that the Java CVE's contain only the affected versions?

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that ...
LML's user avatar
  • 13
1 vote
2 answers
331 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
user avatar
5 votes
2 answers
5k views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
Chris's user avatar
  • 193
1 vote
1 answer
627 views

Is disabling Remote Desktop Services sufficient to protect a Windows device from the BlueKeep vulnerability?

Microsoft (and the NSA) have been urging Windows users and administrators to install patches to protect systems from the BlueKeep (CVE-2019-0708) vulnerability. Is disabling Remote Desktop Services ...
RockPaperLz- Mask it or Casket's user avatar
1 vote
0 answers
143 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
Chev_603's user avatar
  • 256
0 votes
1 answer
1k views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
flickerfly's user avatar
57 votes
6 answers
8k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
Filipon's user avatar
  • 1,254
0 votes
1 answer
499 views

External hard drive's hardware vulnerabilities [closed]

You have an external hard drive that was left in a public place. The data is encrypted. What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts ...
Anonyme's user avatar
  • 11
0 votes
1 answer
257 views

Can a CVE be removed from NVD database?

Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or ...
Konstantin Shemyak's user avatar
-1 votes
1 answer
100 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
TripWire's user avatar
1 vote
1 answer
88 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
reed's user avatar
  • 15.7k
19 votes
2 answers
3k views

As an end user, what risk is there in browsing a public website that uses TLSv1?

Is it safe for an end user to browse a website that only supports TLSv1 (or other insecure ciphers or protocols), given the following: it's a publicly accessible website with no sensitive or private ...
Brad Parks's user avatar
1 vote
1 answer
682 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
Azaam's user avatar
  • 23
14 votes
1 answer
4k views

New CVE-2018-5407 "PortSmash vulnerablity" in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
0_o's user avatar
  • 1,142
2 votes
2 answers
143 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
user189906's user avatar
0 votes
3 answers
975 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
MOH's user avatar
  • 31
-2 votes
2 answers
473 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
user4951's user avatar
  • 121
1 vote
1 answer
698 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
Dark Cyber's user avatar
2 votes
2 answers
2k views

How to discover known vulnerabilities (CVEs) in Go executables? [closed]

Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index. Would it be possible to do ...
tsaarni's user avatar
  • 121
1 vote
2 answers
150 views

How do so many vulnerable IoT devices stay alive and online?

With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online? Suppose I have a device online which can be accessed (as root) ...
LangeHaare's user avatar
2 votes
1 answer
261 views

owasp top 10 2017 automation

I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
SyCode's user avatar
  • 210
5 votes
2 answers
326 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
Zenilogix's user avatar
  • 171
0 votes
0 answers
135 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
reed's user avatar
  • 15.7k
0 votes
1 answer
441 views

What is the attack vector for CVE-2018-3639 Speculative Store Bypass?

We use Web Application deployed on a CentOS server. Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server? I cannot understand the attack vector ...
Michael's user avatar
  • 1,479
1 vote
3 answers
645 views

Test for OWASP Using Components with Known Vulnerabilities?

I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities". If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
Bill C's user avatar
  • 11
3 votes
2 answers
7k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
Dennis1818's user avatar
4 votes
1 answer
1k views

Are there any known Python pickle viruses?

I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/ The docs are suggesting ...
abukaj's user avatar
  • 283
1 vote
0 answers
246 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
XsiSec's user avatar
  • 133
35 votes
6 answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
RockPaperLz- Mask it or Casket's user avatar
1 vote
0 answers
65 views

Is my website being checked for vulnerabilities or being attacked? [duplicate]

I have a website running on windows hosting with plesk 11 version and website is based on .net 4.5 by default PHP is also active for this website but is not being used. I have disabled PHP as i am not ...
Learning's user avatar
  • 153

1
2 3 4 5
8