Questions tagged [known-vulnerabilities]

A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

16 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
1answer
656 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
1
vote
0answers
53 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
1
vote
0answers
190 views

How to use a web vulnerability scanner to autenthicate through in order to do the scan

I thinking about use a various mix of different scanner such as: Burp-suite Acunetix Vulnerability Scanner Arachni Owasp Zed Attack Proxy Project Vega W3af though we have Active directory that is ...
1
vote
0answers
142 views

Flash Descriptor write-protection defaults

According to Intel in this article, to exploit Intel SA 00086 an attacker needs physical access if Flash Descriptor write protections are enabled. I assembled my computer myself, and it doesn't look ...
1
vote
0answers
71 views

Can a computer be vulnerable to BroadPwn?

There is a lot of info and warnings about most phones using Broadcom BCM43xx WiFi chipset that are vulnerable to remote code execution and full takeover. What about computers? I saw that MacOS also ...
1
vote
1answer
836 views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
1
vote
0answers
677 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
1
vote
0answers
179 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
1
vote
0answers
351 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] vulnerable ...
1
vote
0answers
127 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
1
vote
1answer
4k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
0answers
22 views

What are the vulnerabilities of the autofill feature in iOS 11 and later?

iOS 11, 12, and later offer an autofill function from the iOS keyboard for specific apps enabled for the function. I have read Apple's documentation and it appears that the passwords are stored in the ...
0
votes
0answers
56 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
0
votes
0answers
87 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
0
votes
0answers
953 views

How to exploit web browsers sandbox?

I have read a few articles about researchers being able to use flash or java vulnerability to bypass web browsers sandbox and hack a system. Can someone explain how such attacks work? Here is an ...
-1
votes
1answer
1k views

The correct way to check for vulnerability CVE-2014-7169 (aftershock)

I found two ways of checking for the vulnerability CVE-2014-7169 (aftershock or taviso bug) bashcheck uses: cd /tmp;rm echo 2>/dev/null X='() { function a a>\' bash -c echo 2>/dev/null > ...