A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

4
votes
3answers
492 views

Vulnerable java applications

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
5
votes
4answers
461 views

Is not checking the src url a vulnerability?

By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
2
votes
2answers
331 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
6
votes
4answers
342 views

Worst case scenario of having the ability to remotely write files to disk as admin

I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
4
votes
4answers
566 views

VGA/HDMI Based Attack

Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side? How about HDMI or DVI? And if so, are there known malware or PoCs to do that? or is it theoretically ...
0
votes
1answer
424 views

apache mod_isapi public exploits

In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll. I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
1
vote
1answer
469 views

Apache mod_rewrite vulnerability

The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
16
votes
3answers
366 views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
2
votes
1answer
7k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 ...
2
votes
2answers
129 views

Any solution to passing a penetration test for an outdated php web application without upgrading the application?

A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
4
votes
3answers
2k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
1
vote
2answers
356 views

Microsoft SQL server 2000 sp3a - isn't it oudated?

I just noticed that many servers use Microsoft SQL server 2000. But isn't 2000 outdated by 2003? Why are people still using 2000? Would there be any serious security vulnerability by using Microsoft ...
2
votes
2answers
674 views

Vulnerability of a computer behind a serial port?

Let’s consider these 4 computers : East Coast location : computer East1 is connected to the internet. computer East2 is connected to East1 through a RS232 serial cable. West Coast location : ...
2
votes
1answer
263 views

How does malware such as Stuxnet and Flamer propagate through USB memory sticks?

The best explanation I found is from this article but it still is unclear to me. Apparently a new vulnerability has been found involving .lnk files where when a folder on the memory stick containing ...
2
votes
2answers
669 views

Interesting article on a vulnerability found in Tor

This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out ...
0
votes
1answer
533 views

Is this Ubuntu server configuration secure?

I'm new to Linux and security matters. I have a vps with Ubuntu 12.04 server and I wonder how secure this server is. I set up ssh passwordless login and disabled ssh login for root. I update security ...
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
1answer
119 views

Types of attacks outside of AppSec and Vendor-Specific Systems?

I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
2
votes
2answers
80 views

Does the CVSS impact score correpond to probability?

From http://nvd.nist.gov/cvsseq2.htm , I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact , 0.275 for partial ...
0
votes
2answers
93 views

Looking for information about CVE-2006-6876 vulnerability

In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server. But I ...
0
votes
0answers
35 views

more justification for the impact scores used by the national vulnerability database [duplicate]

Possible Duplicate: why CVSS give a score of 0.66 for a full impact on CIA? Good day ; the CVSS attributes the following impact values ​​for confidentiality, integrity and availability: ...
0
votes
1answer
110 views

How can I remotely detect versions? [closed]

I want to know how to remotely detect a software version. Once attacker knows the version installed, he can exploit published vulnerabilities. So it will be useful to know it when doing penetration ...
5
votes
1answer
118 views

Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?

I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
0
votes
1answer
888 views

More information about CVE-2012-0883 vulnerability

I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883 Second, I need to know , what mean DSos mentioned on the ...
0
votes
1answer
129 views

why CVSS give a score of 0.66 for a full impact on CIA?

By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values ​​for confidentiality, integrity and availability: none : 0.0 partial impact : ...
2
votes
3answers
888 views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
1
vote
1answer
354 views

Where do I find more information about a given hacking attempt requests to my website?

Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this: Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
1
vote
2answers
397 views

What are best practices for implementing Remote Desktop within a corporation?

After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution' I have been looking for a hardening checklist or in the scenario that I am an ...
-2
votes
1answer
134 views

Why did I get unresponsive script when I start my system and open web browser? [closed]

The script on opening web broswersays Warning: Unresponsive Script A script on this page may be busy,or it may have stopped responding.You can stop the script now,or you can continue to see if the ...
3
votes
2answers
209 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
4
votes
2answers
1k views

Fuzzing with SPIKE - the \r\n not being taken into account

I would like to fuzz FTP protocol, and currently I have the following: s_read_packet(); s_string("USER test\r\n"); s_read_packet(); s_string("PASS test\r\n"); s_read_packet(); I've also tried ...
15
votes
4answers
1k views

Security risks of scanning an unknown QR code

What are the security risks of scanning a QR code from an untrusted source? If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
2
votes
3answers
572 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
4
votes
2answers
287 views

Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?

Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
1
vote
3answers
3k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
4
votes
1answer
592 views

How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?

I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
3
votes
1answer
205 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
2
votes
4answers
818 views

Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?

Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers. Additional integration ...
1
vote
2answers
100 views

Can I instruct a Telco to prevent 2G connections from our phones?

Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices? Some cell phones are unable to ...
4
votes
2answers
493 views

Could the bcrypt-ruby binding be vulnerable?

While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
-1
votes
1answer
3k views

Dropbear SSH server use-after-free vulnerability

"This vulnerability is located within the Dropbear daemon and occurs due to the way the server manages channels concurrency. A specially crafted request can trigger a use after free condition which ...
2
votes
1answer
366 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
2
votes
2answers
483 views

Vulnerabilities and Threats to Non Web Based Windows Applications

I believe that most people here are familiar with OWASP and their Top 10 project. When it comes to information systems these days it appears that there is a big focus on web application security and ...
1
vote
1answer
888 views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
1
vote
2answers
3k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
0
votes
2answers
454 views

TimThumb security alternative or fix?

"An image resizing utility called timthumb.php is widely used by many WordPress themes....The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code ...
3
votes
2answers
528 views

HTML Vulnerabilities

My question is three-fold. Background I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
2
votes
2answers
1k views

Microsoft ASMX Web Services Test form available on remote machines

I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
3
votes
2answers
682 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
6
votes
2answers
388 views

Videos and visual tutorials on Format String Vulnerabilities

Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...