Questions tagged [known-vulnerabilities]
A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.
18
votes
2answers
3k views
As an end user, what risk is there in browsing a public website that uses TLSv1?
Is it safe for an end user to browse a website that only supports TLSv1 (or other insecure ciphers or protocols), given the following:
it's a publicly accessible website with no sensitive or private ...
0
votes
1answer
101 views
How can I determine the vulnerability for a sub domain takeover attack?
I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
13
votes
1answer
4k views
New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU
I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
1
vote
2answers
49 views
Microsoft Windows CVEs?
I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
2answers
142 views
Is there any list of vulnerabilities and their signatures?
I am looking for a list of known vulnerabilities and their signatures.
Is there any publicly available list of security vulnerabilities and their signatures?
NVD (NATIONAL VULNERABILITY DATABASE) ...
-2
votes
2answers
246 views
What are most dangerous vulnerabilities of users of password management? [closed]
Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how?
Basically, I sort of know the typical vulnerabilities ...
1
vote
1answer
261 views
Is Debian 9.5 stretch vulnerable to CVE-2018-17182?
I have a Debian system running the following kernel version:
Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
1
vote
2answers
197 views
How to discover known vulnerabilities (CVEs) in Go executables?
Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.
Would it be possible to do ...
1
vote
2answers
87 views
How do so many vulnerable IoT devices stay alive and online?
With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online?
Suppose I have a device online which can be accessed (as root) ...
2
votes
1answer
129 views
owasp top 10 2017 automation
I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
5
votes
1answer
153 views
CVE-2018-0886 mitigation for an unpatchable RDP server
An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
0
votes
0answers
69 views
How should security patches be managed in public versioning systems (like Github, etc.)?
There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
0
votes
1answer
195 views
What is the attack vector for CVE-2018-3639 Speculative Store Bypass?
We use Web Application deployed on a CentOS server.
Can the attack will be performed via a browser?
Or the attacker need a physical access to the CentOS server?
I cannot understand the attack vector ...
1
vote
3answers
264 views
Test for OWASP Using Components with Known Vulnerabilities?
I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities".
If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
2
votes
1answer
1k views
Common JavaScript Vulnerabilities
Can someone recommend a secure coding guideline for JavaScript?
Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
0
votes
0answers
243 views
How to reproduce Skype DLL hijacking vulnerability?
Recently, a vulnerability was discovered in Skype - specifically, the Skype Updater - which allowed full privilege escalation to SYSTEM. The description of this vulnerability seems fairly ...
3
votes
1answer
262 views
Are there any known Python pickle viruses?
I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/
The docs are suggesting ...
1
vote
0answers
123 views
How to use a web vulnerability scanner to autenthicate through in order to do the scan
I thinking about use a various mix of different scanner such as:
Burp-suite
Acunetix Vulnerability Scanner
Arachni
Owasp Zed Attack Proxy Project
Vega
W3af
though we have Active directory that is ...
35
votes
6answers
10k views
On Windows boxes, is patching for Spectre and Meltdown necessary?
From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
1
vote
0answers
52 views
Is my website being checked for vulnerabilities or being attacked? [duplicate]
I have a website running on windows hosting with plesk 11 version and website is based on .net 4.5 by default PHP is also active for this website but is not being used. I have disabled PHP as i am not ...
166
votes
3answers
15k views
Meltdown and Spectre Attacks
Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one.
Main concerns
What ...
8
votes
1answer
241 views
Is there a documented process for official information release for embargoed vulnerabilities in the CVE system?
Is there a documented process for official information release for embargoed vulnerabilities in the Common Vulnerabilities and Exposures (CVE) system?
If such a process exists, how does it address ...
1
vote
0answers
113 views
Flash Descriptor write-protection defaults
According to Intel in this article, to exploit Intel SA 00086 an attacker needs physical access if Flash Descriptor write protections are enabled.
I assembled my computer myself, and it doesn't look ...
1
vote
2answers
428 views
Checking for hardware vulnerabilities (like Intel Management Engine) semi-automated?
Is there a nice semi-automated way that I would just paste output of my /proc, lspci, or any other hardware description and get suggestions to what kind of vulnerabilities a given computer may be ...
1
vote
0answers
28 views
What can one do to secure holes described by Arnaboldi? [closed]
I have just read: https://www.blackhat.com/docs/eu-17/materials/eu-17-Arnaboldi-Exposing-Hidden-Exploitable-Behaviors-In-Programming-Languages-Using-Differential-Fuzzing-wp.pdf
Which describes some ...
3
votes
3answers
367 views
How to get vulnerabilites by product name and version
I have a list of software installed on workstations which contains product name and version, for example my list contains Mysql Workbench 6.3.8. Searching in CVE Details I found out that this software ...
0
votes
1answer
641 views
How to scan PHP code for vulnerable functions? [closed]
I saw a pentest report and there was a section where the pentester list all the functions that are vulnerable in PHP.
How did he scan the code and what tools can be used, and is it possible to do it ...
4
votes
3answers
265 views
Checking if a web application uses known vulnerable components
I've been doing research on the OWASP top 10 web application vulnerabilties, one of them is using components with know vulnerabilities. I'm a little confused here, as I don't understand how you could ...
0
votes
3answers
90 views
Is it recommended to patch announced vulnerability for unused services or features?
Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
3
votes
2answers
617 views
How can Draytek products not be affected by KRACK as they claim?
According to Draytek on their website,
When DrayTek wireless products, such as wireless routers and access
points, are used as wireless base stations, they are not affected by
the KRACK (Key ...
1
vote
0answers
68 views
Can a computer be vulnerable to BroadPwn?
There is a lot of info and warnings about most phones using Broadcom BCM43xx WiFi chipset that are vulnerable to remote code execution and full takeover.
What about computers? I saw that MacOS also ...
55
votes
3answers
9k views
My Android phone is vulnerable, but there are no updates?
I bought brand new HTC Desire 526G with operating system 4.4.2 (Kitkat), everything is as it should be (not rooted) so it is still on factory settings.
But now I didn't get for a long time any ...
1
vote
0answers
88 views
Is user listing considered a vulnerability? [duplicate]
I couldn't find any other post on stack exchange talking about this.
I have found a way to get a website to list all users and their names. Is this considered a vulnerability? This website does have ...
1
vote
1answer
92 views
About slowloris dos attack in skype
So I scanned my home pc for fun with nmap "vuln" script and it said something about the slowloris vulerability at port 443 . So I started up slowloris.pl and it really worked . After that I wondered ...
2
votes
1answer
191 views
How likely is an attack for a known OTA ring 0 vulnerability in mobile devices?
Following on from this question about a WiFi OTA vulnerability: assume a popular computing platform has a known vulnerability that would allow creation of a worm with access to ring 0 (kernel). Then, ...
2
votes
1answer
370 views
How likely is it that the Hot Potato vulnerability can be exploited on a up-to-date Windows 2012 machine?
I recently found an article about the Hot Potato vulnerability and it seemed quite interesting.
Using this technique, we can elevate our privilege on a Windows workstation from the lowest levels to ...
5
votes
2answers
767 views
WD My Cloud Vulnerabilities - What is at risk?
Recently there were around 70 vulnerabilities found within Western Digital's "My Cloud" devices. I am curious to know more about the scope of these vulnerabilities. All of the vulnerabilities have ...
3
votes
1answer
89 views
Are there any known concrete cases of Cloudbleed attacks?
CloudFlare's Cloudbleed seems like a big deal, with thousands of websites compromised. CNN on February 24, 2017 mentions that it "doesn't appear anyone has exploited it yet." Was CNN right? And a few ...
59
votes
1answer
4k views
What's the Impact of the CloudFlare Reverse Proxy Bug? (“#CloudBleed”)
In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
3
votes
1answer
2k views
Should I worry about an iOS rootkit?
Over the course of several months, I have regularly used my iPhone's default browser for high-risk activities, namely viewing pornography. I have also failed to diligently update iOS (still running ...
0
votes
1answer
74 views
MCC records in JPEG2000
I was looking at some image vulnerabilities and came across the fairly new openjpeg vulnerability in JPEG2000 images. It says that: "out of bounds memory can be accessed due to an error in mcc records ...
1
vote
3answers
659 views
Is it legal/ethical to release commercial software with known security flaws
I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited.
A logged in ...
1
vote
1answer
541 views
Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings
I'm still new to Asterisk/Elastix and apologize if this question is misplaced.
Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
5
votes
2answers
316 views
Fresh install of Windows 7 vulnerable?
A friend got a new Windows 7 computer. His plan was to connect it to the internet and download all the Windows updates.
I told him a better strategy would be to download the patches from another ...
69
votes
7answers
23k views
What is the possible impact of dirtyc0w a.k.a. “Dirty COW” bug?
I heard about Dirty COW but couldn't find any decent writeup on the scope of the bug. It looks like the exploit can overwrite any non-writable file, which makes me guess that local root is possible ...
3
votes
1answer
3k views
Security of AES against known plaintext attack if no IV is used?
I understand the the statement that "AES is not currently vulnerable to known-plaintext attack" but I assume that there is an implicit rider in that statement that should be read "when used in an ...
3
votes
2answers
1k views
Segmentation fault trying to exploit printf vulnerability
I am trying to learn more about printf vulnerability. I understand the theory but I am unable to put it into practice.
TL;DR
All my attempts to write a single byte into memory result in a ...
0
votes
0answers
773 views
How to exploit web browsers sandbox?
I have read a few articles about researchers being able to use flash or java vulnerability to bypass web browsers sandbox and hack a system. Can someone explain how such attacks work?
Here is an ...
1
vote
1answer
630 views
Sweet 32: Which applications we consider vulnerable?
Backgound
There is a lot of hype about the Sweet 32 paper in the recent days. The paper shows that 64bit block size symmetric cyphers are too vulnerable today, it performs a birthday attack on ...
5
votes
4answers
923 views
I'm running Android 4.1.2; it includes known vulnerabilities. Installing a newer firmware image would take time and effort. Must I really do so?
Background
My Android phone is rather old. It's running stock Android 4.1.2, which includes known security vulnerabilities. Unfortunately, this is the latest firmware which T-Mobile offers for this ...
