Questions tagged [known-vulnerabilities]

A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

Filter by
Sorted by
Tagged with
5
votes
2answers
993 views

WD My Cloud Vulnerabilities - What is at risk?

Recently there were around 70 vulnerabilities found within Western Digital's "My Cloud" devices. I am curious to know more about the scope of these vulnerabilities. All of the vulnerabilities have ...
3
votes
1answer
90 views

Are there any known concrete cases of Cloudbleed attacks?

CloudFlare's Cloudbleed seems like a big deal, with thousands of websites compromised. CNN on February 24, 2017 mentions that it "doesn't appear anyone has exploited it yet." Was CNN right? And a few ...
59
votes
1answer
4k views

What's the Impact of the CloudFlare Reverse Proxy Bug? (“#CloudBleed”)

In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
3
votes
1answer
4k views

Should I worry about an iOS rootkit?

Over the course of several months, I have regularly used my iPhone's default browser for high-risk activities, namely viewing pornography. I have also failed to diligently update iOS (still running ...
0
votes
1answer
85 views

MCC records in JPEG2000

I was looking at some image vulnerabilities and came across the fairly new openjpeg vulnerability in JPEG2000 images. It says that: "out of bounds memory can be accessed due to an error in mcc records ...
1
vote
3answers
936 views

Is it legal/ethical to release commercial software with known security flaws

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited. A logged in ...
1
vote
1answer
892 views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
4
votes
2answers
399 views

Fresh install of Windows 7 vulnerable?

A friend got a new Windows 7 computer. His plan was to connect it to the internet and download all the Windows updates. I told him a better strategy would be to download the patches from another ...
69
votes
7answers
23k views

What is the possible impact of dirtyc0w a.k.a. “Dirty COW” bug?

I heard about Dirty COW but couldn't find any decent writeup on the scope of the bug. It looks like the exploit can overwrite any non-writable file, which makes me guess that local root is possible ...
3
votes
1answer
5k views

Security of AES against known plaintext attack if no IV is used?

I understand the the statement that "AES is not currently vulnerable to known-plaintext attack" but I assume that there is an implicit rider in that statement that should be read "when used in an ...
3
votes
2answers
2k views

Segmentation fault trying to exploit printf vulnerability

I am trying to learn more about printf vulnerability. I understand the theory but I am unable to put it into practice. TL;DR All my attempts to write a single byte into memory result in a ...
0
votes
0answers
959 views

How to exploit web browsers sandbox?

I have read a few articles about researchers being able to use flash or java vulnerability to bypass web browsers sandbox and hack a system. Can someone explain how such attacks work? Here is an ...
1
vote
1answer
666 views

Sweet 32: Which applications we consider vulnerable?

Backgound There is a lot of hype about the Sweet 32 paper in the recent days. The paper shows that 64bit block size symmetric cyphers are too vulnerable today, it performs a birthday attack on ...
5
votes
4answers
1k views

I'm running Android 4.1.2; it includes known vulnerabilities. Installing a newer firmware image would take time and effort. Must I really do so?

Background My Android phone is rather old. It's running stock Android 4.1.2, which includes known security vulnerabilities. Unfortunately, this is the latest firmware which T-Mobile offers for this ...
2
votes
2answers
2k views

Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]

Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why? Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
0
votes
1answer
200 views

How come Chrome developers aren't taking any initiative against crashsafari.com?

How come Chrome developers aren't taking any initiative against crashsafari.com ? Its a know vulnerability so they should patch it. Shouldn't they ? By this I mean they should be 'defensive' and ...
2
votes
1answer
680 views

Are there open databases or sites similar to xssed.com, not necessarily about XSS?

Are there open databases, websites similar to xssed.com that are not necessarily about XSS, but where people report SQL inject-able websites or malware infected websites, for example? Potentially ...
3
votes
2answers
162 views

How can I convey risks associated with out-of-support software?

Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS....
5
votes
4answers
268 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
3
votes
2answers
786 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
0
votes
4answers
1k views

Where can I find real life examples of software vulnerabilities in OSS?

I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly ...
4
votes
2answers
282 views

Why does SSL Labs say that POODLE is mitigated if a server chooses RC4?

I always thought that if a server supports SSLv3 and CBC ciphers, then it is vulnerable to POODLE. But it looks like that is not the case. For example, for Google.com, SSL Labs says that the SSL ...
7
votes
2answers
252 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
7
votes
1answer
4k views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
2
votes
2answers
559 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
4
votes
2answers
511 views

Software Library Vulnerability Tracking

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities. Is anyone aware of any comprehensive data sources aside ...
5
votes
1answer
422 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
2
votes
3answers
103 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
-2
votes
1answer
93 views

Threats for video files [closed]

I'm trying to figure out what are the known vulnerabilities in video file formats? And, if by any chance, anyone knows about an application to scan or whitelist these files from any harmful ...
2
votes
3answers
329 views

Where to find about web application vulnerabilities' history? [closed]

There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, ...
2
votes
1answer
716 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
6
votes
2answers
179 views

Are any inherently insecure AES-CBC keys or key-IV combos known for properly generated random values?

This is mostly a theoretical question. I am using AES128 CBC to encrypt small files. Both my keys and my IVs are randomly generated per file using iOS's secure random value generation (...
11
votes
5answers
3k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
2
votes
1answer
92 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android app,...
1
vote
0answers
66 views

How to react to the glibc vulnerability as an OSX user? [duplicate]

Apologies if this question isn't really fit for this SE site. Wasn't sure whether to post it here, or on apple.SE. What's the currently best way for a user of OSX to react to: https://...
0
votes
1answer
178 views

Can the latest glibc DNS vuln be tested on remote servers?

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely ...
0
votes
1answer
784 views

GNU C Library getaddrinfo() Flaw

As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow ...
0
votes
2answers
522 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
0
votes
1answer
136 views

Can CVEs (or any vulnerability) be dependent on one another?

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same ...
1
vote
0answers
686 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
20
votes
2answers
11k views

How exploitable is the recent UseRoaming SSH vulnerability?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
12
votes
3answers
1k views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
1
vote
1answer
243 views

How to patch haproxy for OpenSSL vulnerability USN-2830-1

This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on ...
44
votes
3answers
56k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
5
votes
1answer
2k views

How to protect from ROM-0 via port triggering?

I'm using an anti-virus that told me that my router can be compromised with the ROM-0 vulnerability. It told me to use "port forwarding" to fix it. But, my router have a "port triggering", which they ...
1
vote
0answers
183 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
5
votes
2answers
681 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the "...
11
votes
2answers
35k views

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

I am no expert in this area but after some searching I am not too sure about the solution. An external vendor doing a pentration test on our server reported that we have ...
3
votes
3answers
73 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
2
votes
2answers
190 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...

1
2
3 4 5
8