Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

4
votes
0answers
41 views

Is it possible to get infected by opening an email in Android Gmail app?

I just received an email from an unknown person, titled "da vinci" and containing a docx file with the same name. Not suspicious at all, right? I have not opened or downloaded the file, but: The ...
5
votes
1answer
154 views

What are some examples of viruses/exploits with benevolent purposes?

A comment from another user had me thinking. What are some well-known (or perhaps not quite so) examples of in-the-wild "malicious" software that do nothing actually malicious, but instead takes ...
1
vote
1answer
57 views

About Android's PNG vulnerability

I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can ...
3
votes
1answer
124 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
1
vote
1answer
142 views

PCI scan shows unknown vulnerabilities

Basit Submit Module Cross Site Scripting Vulnerability DCP-Portal Cross Site Scripting Bugs, CVE-2004-2511 CVE- 2003-1536 CVE-2004-2512 These two vulnerabilities have been identified in the scan ...
0
votes
0answers
33 views

Bad Connections Blocked

With a new Windows 10 computer, McAfee Livesafe is reporting nearly 20,000 bad connections blocked. I ran some tests from Gibson Research, including the UPnP Exposure Test and the All Port Scan. The ...
1
vote
1answer
102 views

Enterprise Standard for Linux server Penetration Testing

Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers? I want to know if there are any most common/important vulnerabilities ...
1
vote
1answer
105 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
5
votes
4answers
124 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
36
votes
9answers
11k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
0
votes
0answers
78 views

encrypting TCP and UDP with self signed cert

I don't have much experience in computer security and I am developing a server for a project. I'm using a tcp connection and UDP packets for some real time data transmission. I want both of these ...
1
vote
2answers
50 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
-1
votes
0answers
52 views

How to determine if a “Windows Security” popup is genuine?

I wrote a program that access the Windows Certificate Store. I then get this popup: But it is not a UAC type popup so I can then easily write a "fake" popup to slurp passwords. How to ensure this ...
0
votes
1answer
217 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
0
votes
1answer
155 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
2
votes
2answers
36 views

Insecure Direct Object Reference - Change email from client end

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...
3
votes
1answer
75 views

How to request CVE if CNA didn't provide an answer

A couple of weeks ago I have found a vulnerability in a product. I have contacted them reporting it a week ago and also to get the CVE. I didn't receive any answer from the mailing list and I would ...
1
vote
2answers
151 views

What kind of vulnerability is this considered?

I am reverse engineering a binary that is supposed to run as root and performs simple checks on users passwords by reading /etc/shadow. I am able to leak some shadow file entries due to public r/w ...
0
votes
0answers
32 views

TLS Robot testing with robot-detect.py script

Has anybody tested TLS Robot Vulnerability in Qualys WAS with robot-detect.py script (https://github.com/devsecur/robot-attack)? How to run the script for on an internal IP if there writing on step 3....
-1
votes
1answer
76 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
58
votes
6answers
7k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
3
votes
2answers
107 views

Under what circumstances is my website vulnerable to clickjacking?

Most of the examples I have read start with a malicious website. Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking? Can this occur ...
1
vote
0answers
39 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
0
votes
1answer
225 views

How can Remote Code Execution in Unity infect me?

There is a Remote Code Execution Vulnerability in Unity, it sounds like a vulnerability that someone can infect you after they trick you click something, I guess. So assume I hadn't installed the ...
5
votes
1answer
206 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
1
vote
2answers
128 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
80
votes
13answers
24k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
1
vote
0answers
35 views

Receiving constant TX RX from Amazon servers upon router restart and ensues [closed]

I had reason to believe my computer was compromised so I used Wireshark and found out that upon restarting my router and before router opens ports with internet provider it systematically tries to ...
0
votes
0answers
26 views

Are there any Nuget pkg upload vulnerabilities

I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, ...
1
vote
2answers
166 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
0answers
42 views

nmap - No Ports Open [closed]

I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
0
votes
1answer
52 views

External hard drive's hardware vulnerabilities [closed]

You have an external hard drive that was left in a public place. The data is encrypted. What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts ...
1
vote
2answers
74 views

What is the name of a vulnerability that leads to automatically opening received URLs?

I've found a bug in some program that led to automatically opening URLs that were received from other users of the program. However, while writing up a report on it, I realized that I didn't know the ...
1
vote
1answer
130 views

How to report “cryptographic bad practice” to vendor?

An appliance is suffering from "cryptographic bad practice"-class of problem, more details here. It would take quite some person-months to prove just for one firmware version if it can be exploited. ...
1
vote
0answers
48 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
9
votes
1answer
175 views

What is the reason for the increase of CVEs since 2017?

According to CVEdetails.com, there were 6447 CVEs in 2016. In 2017 there were 14714 CVEs. That's 128% more than in 2016. Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
54 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
9
votes
1answer
592 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
1
vote
2answers
246 views

How does an OS execute code from a PNG file? [duplicate]

A recent bug in Android allows a hacker to execute code that is contained within an image file. Here is the quote from the Android Security Bulletin, The most severe vulnerability in this section ...
0
votes
1answer
70 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
1
vote
1answer
68 views

OAuth 2.0 when and how to use the client id and secret

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
1answer
160 views

is SSRF attack or vulnerability?

I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?
0
votes
1answer
29 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
2
votes
2answers
182 views

Vulnerability in using `input type=“text”` for website password other than shoulder surfing

I found a website that uses the plain text field as a password input form. <input type = "text" autocomplete= off ...> I understand shoulder surfing is one vulnerability but are there other ...
0
votes
0answers
49 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
4
votes
2answers
269 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
1answer
248 views

How to do Mobile application testing using Burp Suite on latest ios and android devices

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices. Here are the settings below which I have done in below points. I made sure that my ...
-1
votes
1answer
43 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
1
vote
1answer
40 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
2
votes
1answer
121 views

How does wireless keyboards' encryption prevent frequency analysis?

I've found very little information on this topic after much googling. The only partial answer I found was by Microsoft: Microsoft_AES_Technical_Factsheet By adding random data to each message, each ...