Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

0
votes
0answers
27 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
0
votes
0answers
36 views

CVE-2018-14667; generating a valid payload for RichFaces 3.X

I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload ...
-2
votes
0answers
38 views

Secure coding standards' effect on vulnerabilities [closed]

1) Does CERT-C, C++, or Java rule compliance reduce the number of vulnerabilities introduced into a code base? 2) Do recent MISRA-C and C++ language subsets reduce the number of vulnerabilities ...
0
votes
1answer
56 views

IDORs on System level object and user level object

I would like to ask a scenario where by an Insecure Direct Object Reference (IDOR) is present for System level objects. For example, if there are different transaction routes (r1) defined by the ...
0
votes
1answer
53 views

XSS vulnerability in a module that doesn't exist

We did a vulnerability scan on our systems and received a vulnerability: Basit Submit Module Cross Site Scripting Vulnerability. We are not even aware of this application on our system. We filed a ...
0
votes
2answers
60 views

Why Empire Launcher payload is not working in system() in PHP?

Technical details:- Created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string. Now I ...
-1
votes
1answer
59 views

How secure is virtualization against breaking out of the box [closed]

How secure are all currently used virtualization technologies (containers - BSD Jail, OpenVZ, Hypervisors - Hyper-V, KVM etc)? I heard about one vulnerability in VMware software, which lets you ...
0
votes
0answers
7 views

Legal issues of searching for software vulnerabilities [migrated]

What are the legal issues about finding zero-day vulnerabilities (i.e. previously unknown vulnerabilities in a program/website) and what is the standard legal practices before trying to find them if ...
0
votes
0answers
31 views

Problem Exploiting Plugin WPML 2.0.4.1 for Wordpress Vulnerability

First some context. I am Working for a company learning about Security Web Services. They have a main application and a blog. I've been looking vuln. in the main webapp for a while, but then I start ...
0
votes
2answers
90 views

risk threat vulnerability

From ENISA - Threat and Risk Management Identification, analysis and evaluation of these threats and vulnerabilities are the only way to understand and measure the impact of the risk involved ...
0
votes
1answer
119 views

How to disclose an open S3 bucket?

What is the most responsible way of disclosing an open AWS S3 bucket? Let's say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it ...
10
votes
2answers
241 views

Is it possible to get infected by opening an email in Android Gmail app?

I just received an email from an unknown person, titled "da vinci" and containing a docx file with the same name. Not suspicious at all, right? I have not opened or downloaded the file, but: The ...
5
votes
2answers
206 views

What are some examples of viruses/exploits with benevolent purposes?

A comment from another user had me thinking. What are some well-known (or perhaps not quite so) examples of in-the-wild "malicious" software that do nothing actually malicious, but instead takes ...
1
vote
1answer
67 views

About Android's PNG vulnerability

I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can ...
3
votes
1answer
138 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
1
vote
1answer
147 views

PCI scan shows unknown vulnerabilities

Basit Submit Module Cross Site Scripting Vulnerability DCP-Portal Cross Site Scripting Bugs, CVE-2004-2511 CVE- 2003-1536 CVE-2004-2512 These two vulnerabilities have been identified in the scan ...
0
votes
0answers
55 views

Bad Connections Blocked

With a new Windows 10 computer, McAfee Livesafe is reporting nearly 20,000 bad connections blocked. I ran some tests from Gibson Research, including the UPnP Exposure Test and the All Port Scan. The ...
1
vote
1answer
113 views

Enterprise Standard for Linux server Penetration Testing

Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers? I want to know if there are any most common/important vulnerabilities ...
1
vote
1answer
126 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
5
votes
4answers
130 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
36
votes
9answers
12k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
0
votes
0answers
85 views

encrypting TCP and UDP with self signed cert

I don't have much experience in computer security and I am developing a server for a project. I'm using a tcp connection and UDP packets for some real time data transmission. I want both of these ...
1
vote
2answers
59 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
1answer
651 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
0
votes
1answer
285 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
2
votes
2answers
37 views

Insecure Direct Object Reference - Change email from client end

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...
3
votes
1answer
80 views

How to request CVE if CNA didn't provide an answer

A couple of weeks ago I have found a vulnerability in a product. I have contacted them reporting it a week ago and also to get the CVE. I didn't receive any answer from the mailing list and I would ...
1
vote
2answers
153 views

What kind of vulnerability is this considered?

I am reverse engineering a binary that is supposed to run as root and performs simple checks on users passwords by reading /etc/shadow. I am able to leak some shadow file entries due to public r/w ...
0
votes
0answers
38 views

TLS Robot testing with robot-detect.py script

Has anybody tested TLS Robot Vulnerability in Qualys WAS with robot-detect.py script (https://github.com/devsecur/robot-attack)? How to run the script for on an internal IP if there writing on step 3....
-1
votes
1answer
88 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
58
votes
6answers
7k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
3
votes
2answers
109 views

Under what circumstances is my website vulnerable to clickjacking?

Most of the examples I have read start with a malicious website. Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking? Can this occur ...
1
vote
0answers
39 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
0
votes
1answer
241 views

How can Remote Code Execution in Unity infect me?

There is a Remote Code Execution Vulnerability in Unity, it sounds like a vulnerability that someone can infect you after they trick you click something, I guess. So assume I hadn't installed the ...
5
votes
1answer
210 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
1
vote
2answers
133 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
80
votes
13answers
24k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
1
vote
0answers
37 views

Receiving constant TX RX from Amazon servers upon router restart and ensues [closed]

I had reason to believe my computer was compromised so I used Wireshark and found out that upon restarting my router and before router opens ports with internet provider it systematically tries to ...
0
votes
0answers
44 views

Are there any Nuget pkg upload vulnerabilities

I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, ...
1
vote
2answers
211 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
0answers
60 views

nmap - No Ports Open [closed]

I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
0
votes
1answer
62 views

External hard drive's hardware vulnerabilities [closed]

You have an external hard drive that was left in a public place. The data is encrypted. What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts ...
1
vote
2answers
75 views

What is the name of a vulnerability that leads to automatically opening received URLs?

I've found a bug in some program that led to automatically opening URLs that were received from other users of the program. However, while writing up a report on it, I realized that I didn't know the ...
1
vote
1answer
130 views

How to report “cryptographic bad practice” to vendor?

An appliance is suffering from "cryptographic bad practice"-class of problem, more details here. It would take quite some person-months to prove just for one firmware version if it can be exploited. ...
1
vote
0answers
61 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
9
votes
1answer
185 views

What is the reason for the increase of CVEs since 2017?

According to CVEdetails.com, there were 6447 CVEs in 2016. In 2017 there were 14714 CVEs. That's 128% more than in 2016. Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
80 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
9
votes
1answer
609 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
1
vote
2answers
281 views

How does an OS execute code from a PNG file? [duplicate]

A recent bug in Android allows a hacker to execute code that is contained within an image file. Here is the quote from the Android Security Bulletin, The most severe vulnerability in this section ...
0
votes
1answer
71 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...