Questions tagged [known-vulnerabilities]

A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

Filter by
Sorted by
Tagged with
13
votes
3answers
30k views

How can you check and analyze SSL ports other than 443?

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
1
vote
0answers
138 views

Find the location of a hidden host [closed]

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
3
votes
2answers
5k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
44
votes
3answers
56k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
-2
votes
1answer
83 views

Upgrading Software Version: risk of an unknown vs known vulnerabilities

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software? For example, with every software ...
2
votes
2answers
2k views

DVWA vulnerability list or guide? [closed]

Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide. By guide I mean an exhaustive list of vulnerabilities to work through.
5
votes
2answers
229 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
1
vote
1answer
893 views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
3
votes
1answer
669 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
0
votes
0answers
22 views

What are the vulnerabilities of the autofill feature in iOS 11 and later?

iOS 11, 12, and later offer an autofill function from the iOS keyboard for specific apps enabled for the function. I have read Apple's documentation and it appears that the passwords are stored in the ...
1
vote
1answer
208 views

Remotely exploit Linux kernel with CVE-2017-18017? [closed]

I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually ...
0
votes
2answers
107 views

Can I trust that the Java CVE's contain only the affected versions?

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that ...
0
votes
2answers
201 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
0
votes
1answer
1k views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
37
votes
5answers
10k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
1
vote
2answers
353 views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
1
vote
1answer
500 views

Is disabling Remote Desktop Services sufficient to protect a Windows device from the BlueKeep vulnerability?

Microsoft (and the NSA) have been urging Windows users and administrators to install patches to protect systems from the BlueKeep (CVE-2019-0708) vulnerability. Is disabling Remote Desktop Services ...
2
votes
2answers
885 views

How to discover known vulnerabilities (CVEs) in Go executables? [closed]

Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index. Would it be possible to do ...
19
votes
2answers
3k views

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like: # vim: set someoption=somevalue and will then set those options. This is awesome if I'm ...
1
vote
0answers
55 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
29
votes
2answers
53k views

What are the main vulnerabilities of TLS v1.1?

What are the main vulnerabilities of TLS v1.1? Actually, no RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except the description given in section 1.2 ...
0
votes
0answers
57 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
0
votes
1answer
990 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
57
votes
6answers
8k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
0
votes
1answer
180 views

External hard drive's hardware vulnerabilities [closed]

You have an external hard drive that was left in a public place. The data is encrypted. What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts ...
0
votes
1answer
120 views

Can a CVE be removed from NVD database?

Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or ...
-1
votes
1answer
48 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
1
vote
1answer
41 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
18
votes
2answers
3k views

As an end user, what risk is there in browsing a public website that uses TLSv1?

Is it safe for an end user to browse a website that only supports TLSv1 (or other insecure ciphers or protocols), given the following: it's a publicly accessible website with no sensitive or private ...
4
votes
2answers
791 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
20
votes
2answers
11k views

How exploitable is the recent UseRoaming SSH vulnerability?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
0
votes
1answer
321 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
13
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
1
vote
2answers
81 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
2answers
407 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
6
votes
2answers
3k views

Known security vulnerabilities in JBoss 4.x.x?

We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but I'...
-2
votes
2answers
390 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
1
vote
3answers
276 views

Is there other vulnerabilities than CVE of NVD

I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs? Thx
1
vote
1answer
561 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
1
vote
3answers
416 views

Test for OWASP Using Components with Known Vulnerabilities?

I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities". If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
2
votes
1answer
315 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
1
vote
2answers
101 views

How do so many vulnerable IoT devices stay alive and online?

With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online? Suppose I have a device online which can be accessed (as root) ...
10
votes
4answers
6k views

Exploit-db like websites, where people can search for security bugs

If someone has to decide between 2 very similar server programs, or operating systems, then it searches on sites like: http://www.exploit-db.com/search/ so that there he could get enough ...
17
votes
5answers
3k views

Security risks of scanning an unknown QR code

What are the security risks of scanning a QR code from an untrusted source? If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
2
votes
1answer
186 views

owasp top 10 2017 automation

I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
0
votes
0answers
87 views

How should security patches be managed in public versioning systems (like Github, etc.)?

There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of ...
0
votes
1answer
328 views

What is the attack vector for CVE-2018-3639 Speculative Store Bypass?

We use Web Application deployed on a CentOS server. Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server? I cannot understand the attack vector ...
165
votes
3answers
16k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
3
votes
3answers
894 views

How to get vulnerabilites by product name and version

I have a list of software installed on workstations which contains product name and version, for example my list contains Mysql Workbench 6.3.8. Searching in CVE Details I found out that this software ...
3
votes
3answers
2k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...

1
2 3 4 5
8