Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
0answers
40 views

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
0
votes
3answers
79 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
0
votes
1answer
49 views

How to prioritize npm dev vulnerabilities?

Running SNYK scanning on my code base I find a number of HIGH vulnerabilities when I include the npm dev dependencies (e.g. running SNYK -dev test --file=package.json). Examples of vulnerabilities: ...
0
votes
0answers
38 views

Hardware vulnerabilities vs software threats

What are the key differences between them? I find both of them would also be able to retrieve data from the host system and both also could cause harm. I do not understand why there are people who ...
2
votes
3answers
95 views

How to make sure vulnerability management does not lead to reduced or compromised security

When running vulnerability scans, often a particular version of, say, Node.js is reported to be vulnerable along with a recommendation to update to a higher version. Then we also have insecure SSL/...
3
votes
1answer
106 views

How dangerous are SWEET32 and LUCKY13 vulnerabilities?

I wonder how vulnerable are Sweet32 and Lucky13? I mean, how often do the attackers use these vulnerabilities to gain access?
0
votes
0answers
27 views

Risk, threat, vulnerability with an example

Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate: Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
2
votes
1answer
69 views

What is the risk of having an old, Internet capable phone not used for Interned compromised? (not smartphone)

I'm talking about a class of old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the ...
1
vote
0answers
38 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
0
votes
0answers
59 views

Disable vulnerable cipher suites

Pardon this question because I'm fairly new as a security analyst. As a part of my learning I installed OpenVAS into one of our Ubuntu test server and scan the said server. I have the results and I ...
0
votes
1answer
97 views

Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL?

If a website uses an auto-incrementing user-id in its url – /users/1, /users/2 to showcase public user profiles (just the name + photo / avatar) is it considered a possible vulnerability?
14
votes
2answers
3k views

Is a crash always exploitable for RCE?

Reading papers written by teams looking for vulnerabilities using fuzzing, I notice that many people label a crash as a DoS vulnerability. While in other papers and researches, they go deeper after ...
0
votes
1answer
60 views

Is NSA disclosure of CRYPT32 vulnerability a charitable public service? [closed]

News coverage of this makes it sound like the NSA is mending fences and helping us all out, kindly and heroically. I have nothing against the NSA but isn't it more likely an adversary has been ...
38
votes
7answers
13k views

Is it a security vulnerability to tell a user what input characters are valid/invalid?

For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field? CWE-200: Information Exposure says one ...
1
vote
1answer
80 views

vulnerability management, risk mitigation vs risk acceptance

I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be ...
1
vote
2answers
236 views

Can a program that doesn't explicitly take user input be hacked?

I'm learning about security, and it seems that all of the security problems I have seen come from input from malicious actors. I was told that it's possible to check for the existence of bugs in a ...
1
vote
1answer
39 views

Should we do request manipulation or network packet manipulation for SDN vulnerability analysis? [closed]

I am planning to do vulnerability analysis of a Software Defined Network. Since the connection between the business apps and the controller of the SDN would be done over the application layer, I would ...
1
vote
1answer
134 views

Is an OS more vulnerable while it is being updated?

Are there any additional attack vectors that apply when an OS is being updated? For example, would the services that are being updated be unstable? An OS is generally more secure after being updated, ...
0
votes
1answer
121 views

What is next step after nmap + metasploit? [closed]

When I'm working on hack boxes, what I do (if not using Armitage) is: nmap the box to discover running services version search metasploit to find a working exploit for that version Now I'm stuck. ...
0
votes
2answers
135 views

How to prevent XSS attacks in ASP web application [closed]

In my web application, while doing the penetration testing two XSS vulnerabilities identified in some text input. that field testing using followin cheets, <script src="http://192.168.1.122:3000/...
1
vote
0answers
59 views

How do gadget chains work in relation to Java Deserialization attacks?

tl;dr I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific. The background This is my attempt to add specificity to the OP question as requested ...
2
votes
0answers
61 views

Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?

I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
2
votes
2answers
125 views

How do you handle vulnerabilities in internal systems?

A constant source of debate I've seen between engineers and security teams is how to handle vulnerabilities in internal systems. Specifically, vulnerabilities in linux packages (like gcc, libcurl, ...
1
vote
2answers
86 views

Would a user editable URL be subjected to client vilnerability?

I am working on an android application and the company request is to be able to potentially have a user edit the API URL the app uses to be able to work with different test environments. This ...
0
votes
0answers
44 views

What to consider for determining something as a security flaw?

Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
0
votes
1answer
44 views

Difference between CVE and OSVDB?

Can someone explain the differences between a CVE and an OSVDB identifier? Both seem to serve the purpose of uniquely identifying a vulnerability or an expose, however not every OSVDB entry also has a ...
13
votes
0answers
140 views

What was the original intent for the feature that StrandHogg uses?

The "Affinity" of Android tasks seems really complex to handle. The StrandHogg vulnerability uses tricks with "Affinity" to render itself inside an another app. The information that I've found this ...
1
vote
0answers
42 views

How to configure webapplication vuln scanner for local web apps [closed]

I am in the process of evaluating a number of webapp vuln scanners. For this task, I attack intentionally vulnerable web apps. So far I tried: Scanner > BurpPro Scanner, arachni, ZAP, wapiti, nikto, ...
-2
votes
1answer
175 views

Is editing a link using inspect element a valid XSS attack?

Using inspect element, I can edit a link opens a popup in edge with the text "1". Is it a possible XSS attack?
0
votes
0answers
40 views

Exploitation differences between Docker and VirtualBox for CVE-2010-4221

I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability. I ...
1
vote
0answers
71 views

How is mkdir subject to a TOCTOU attack?

My answer here, resulted in this comment: This could be subject to a TOCTOU1 attack and needs to be developed to be correct. The answer is in Rust, but here's some equivalent bash: p=/home/roger/...
2
votes
1answer
171 views

What are the security implications of invalid free()?

CVE-2009-5030 OpenJPEG: Heap memory corruption leading to invalid free The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (...
2
votes
2answers
80 views

Is it correct to assign a CVSS to a misconfiguration?

This morning, talking to a colleague, we were discussing the correction of assigning a CVSS to a bad configuration. Specifically, we were discussing whether using HTTP instead of HTTPS should have an ...
3
votes
1answer
160 views

Can simply opening an email lead to a hack? [duplicate]

It is common to be wary of links and attachments in emails but I have heard some people say that opening the emails themselves can be risky. Are vulnerabilities that can be exploited simply by opening ...
1
vote
0answers
104 views

Are some Free VPN services secure or not? [closed]

After deciding to be security engineer, everything that I do, for example visiting pages, downloading any content or apps, etc. seems suspicious. So today I encountered something strange in my new VPN....
1
vote
2answers
94 views

Monitoring the HTTP(S) calls being made from android App

I want to test for security vulnerabilities in an Android App and hence want to monitor all HTTP(S) calls being made from an Android App. I have setup BurpSuit in my Laptop and have also set up the ...
0
votes
1answer
58 views

How to judge website security?

How can I know if visiting a website is safe? Is a scan with virus total good enough? If it says that the website is clean then can I be sure that I won't get hacked by visiting it? Could a website ...
2
votes
0answers
57 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
1
vote
1answer
50 views

Can website exploit kits contain bootkits?

Can a website exploit kit theoretically contain a bootkit (it flashes your UEFI/BIOS)?
0
votes
2answers
436 views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
139
votes
17answers
22k views

Is exploit-free software possible?

I have heard that there will always be vulnerabilities in codes, software. However, I don't understand why it is not possible to have an exploit-free software. If companies keep updating their ...
2
votes
1answer
598 views

Sacrificing 30% of my CPU performance (by disabling Hyper-Threading) to fully mitigate CPU vulnerabilities, necessary?

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
1
vote
1answer
145 views

Is the “2038 bug” considered as a vulnerability? is it possible to exploit this? [closed]

Is it possible to use the "2038 bug" on all kinds of systems / sites that use a calendar and similar features, in order to exploit a certain system in some way?
0
votes
1answer
58 views

can you have reflective xss through a POST parameter?

While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload)...
0
votes
2answers
285 views

How do I sell critical vulnerability info to private company? [closed]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
2
votes
2answers
341 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
1
vote
1answer
119 views

HTTP header injected in meta tag

When I add the HTTP header X-Forwarded-Host: bing.com, a meta tag is injected into the site: <meta property="og:url" content="https://bing.com/argentina"/> Does this have any security impact? ...
0
votes
1answer
69 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log? I was asked to do log review. The logs include IIS Log and Event Log. Is there any tools to detect if there's any ...
0
votes
0answers
47 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
1
vote
0answers
70 views

Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing

Someone requested my site's (Wordpress/Apache) 'includes' directory: 122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" Noticing the 200 response, I hit ...

1 2 3 4 5 17