Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

Maintenance mode errors in Nexpose [closed]

I installed nexpose yesterday. And when I start the server in maintenance mode, I initialize the console with the command sudo sh nsc.sh and it throws me out the following errors: 14:07:14,340 |-ERROR ...
user avatar
0 votes
0 answers
26 views

What are some common vulnerabilities in APIs?

While doing web application security in startup companies, I am exposed to some backend APIs that integrate with the client web app, but testing APIs is a completely different procedure that I do not ...
user avatar
  • 1
0 votes
2 answers
48 views

File Upload(what type of file)

While I was learning about file upload vulnerability one question come to my mind. What type of file do I use while hunting file upload vulnerability ? Do I need to detect which programming language ...
user avatar
1 vote
0 answers
36 views

Ramifications of the psychic/CVE-2022-21449 ECDSA verification vulnerability

On 2022-04-19, Neil Madden published a vulnerability in the ECDSA signature verification code of the library bundled with some editions of Java, including some recent by Oracle and in OpenJDK. That ...
user avatar
  • 1,020
0 votes
0 answers
24 views

How can I inject JavaScript into a url whose contents will be written to the DOM in a way that it could execute?

I'm working with the API for a popular CI/CD app and I found a bug where path variables are being written directly to the DOM without being checked first. The tldr is that to access a project you go ...
user avatar
0 votes
1 answer
26 views

HTML Injection into custom sanitiser

I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting. But it doesn't let you do more ...
user avatar
  • 101
0 votes
0 answers
28 views

CVE-2021-4034 : __environ is init before the GCONV_PATH injection

I am a bit late to the party but I decided to look into the polkit vulnerability (CVE-2021-4034). I get that the code injection comes from iconv loading an arbitrary library file through the ...
user avatar
-1 votes
1 answer
51 views

Cyber Security skills development advice [closed]

I'm looking to shift my job / skillset over to the cyber security field. I'm currently in the script kiddy stages of my knowledge and wanted to move past this and locate/identify vulnerabilities ...
user avatar
  • 9
0 votes
1 answer
48 views

How secure is the Wyze Cam? How easily could an attacker gain access to it? [closed]

I recently put up a Wyze Cam, a brand of Wi-Fi security camera, and I am curious as to how (in)secure it is. I heard that the Wyze company servers got breached once before. How easily could an ...
user avatar
0 votes
0 answers
19 views

Are there some routers that have WPS, but without a fixed Pin?

My router only seems like to support the push button method, but I thought every router with wps has a fixed wps pin, or am I wrong?
user avatar
0 votes
0 answers
22 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
user avatar
  • 101
1 vote
1 answer
75 views

spring4shell correction in tomcat

We use Tomcat, and version Tomcat 9.0.62 is supposed to fix the spring4shell vuln. To what extent is it the case? Are we safe not to upgrade to the latest Spring version?
user avatar
2 votes
0 answers
97 views

Windows XP SP3 2002 is not vulnerable to MS08-067

Why is my VM not vulnerable to MS08-067? There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
user avatar
6 votes
4 answers
4k views

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

I am trying to better understand and determine the impact and implications of a web app where data tamping is possible. When discussing data tampering, I am referring to when you are able to use a ...
user avatar
  • 197
2 votes
0 answers
31 views

Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"

While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
user avatar
  • 111
4 votes
2 answers
2k views

Acceptably resolving a serious vulnerability disclosure

Hypothetical scenario: An organisation with a large user base who rely on the service's end to end cryptography has a comprehensive vulnerability disclosure made to it privately from a research ...
user avatar
  • 41
-2 votes
2 answers
57 views

Vulnerabilities due to improper use of cipher's mode of operation? [closed]

I want to know if there was any vulnerability discovered - whether known to be exploited or not - in cryptographic systems due to improper use of the underlying block-based encryption algorithm's mode ...
user avatar
  • 1
0 votes
0 answers
62 views

trying to test the vulnerability CVE 2015-0205 for university project

I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes. I found this explanation of CVE-2015-0205: ...
user avatar
0 votes
1 answer
70 views

C++: How does format string vulnerability work?

Lets say that: char name[50]="TEST"; printf("%s",name); Here in the code, the %s just says that the variable is a string. But why when we print out user inputs, the %s suddenly ...
user avatar
1 vote
1 answer
190 views

How can malware or a hacker penetrate a firewall from external perimeter?

How can malware or a hacker penetrate a firewall in a router/AP or a dedicated firewall without "help from the inside" (running malicious script on a computer, forgotten open ports with port ...
user avatar
  • 33
0 votes
0 answers
50 views

can hackers access a subnet in different network? [duplicate]

If I'm in my private network with my IP 192.168.4.5 and public IP 34.124.x.x, can hackers access my computer only with exploit/vulnerability (no malware) from a different network? The videos, sites ...
user avatar
0 votes
0 answers
42 views

Is there a configuration which would have prevented the recent Firefox vulnerability mfsa2022-09?

Recently, some critical vulnerabilities, mfsa2022-09 were discovered in Firefox. Can someone tell if there is any configuration in Linux or Firefox that could have prevented an exploitation of this ...
user avatar
  • 127
0 votes
1 answer
40 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
user avatar
0 votes
0 answers
43 views

Overlap between Wired vs WiFi vulnerabilities

This is a fundamental question, but, I'm interested in understanding the "venn diagram" of attack vectors between wired and Wi-Fi connections. What are the attacks that both wired and Wi-Fi ...
user avatar
0 votes
0 answers
41 views

Where do you report a product vulnerability? [duplicate]

There is a bug in a widely used payment processing SAAS provider that I have tried reporting to them. And if they had showed it to an engineer they would have understood. I don't have time to keep ...
user avatar
  • 335
0 votes
0 answers
10 views

What are some safe ways to play a video file that was downloaded from the internet? [duplicate]

I would like to know what are some safe and easy ways to play a media (in particular, video) file that I downloaded from the internet, from an untrusted source. I know that if I use an open-source ...
user avatar
2 votes
0 answers
2k views

What exactly is the pkexec bug and how to patch it on CentOS 7? [closed]

There is bug in pkexec program, CVE-2021-4034, which when exploited allows access to root shell. Is the best way to fix an unpatched CentOS 7 server to just apply the temporary fix of running chmod ...
user avatar
0 votes
1 answer
162 views

BASH vs SH (dash, etc.) in terms of security [closed]

Since I am new to Linux, when writing scripts I always followed the rule "the less code, the less attack surface", so I try to write scripts with privileged access (sudo, root, etc.) in sh ...
user avatar
  • 635
0 votes
0 answers
19 views

Does process injection through file on a low privilege user considered as a vulnerability

I found a way to cause a low privileged program in Program Files to run any binary I want. I am doing it by changing a configuration file it reads, which I of course have an access to. Is it ...
user avatar
  • 153
1 vote
1 answer
125 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
user avatar
0 votes
0 answers
813 views

Logback's CVE-2021-42550 - Is this really a vulnerability?

I'm really struggeling with understanding CVE-2021-42550. Logback says: A successul RCE attack with CVE-2021-42550 requires all of the following conditions to be met: write access to logback.xml use ...
user avatar
0 votes
0 answers
581 views

Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?

From an article for the new Log4j vulnerability, it reads here: A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
user avatar
0 votes
2 answers
2k views

Is Xcode vulnerable due to log4j?

After the log4j vulnerability was announced, I scanned my Mac to see if any applications were using it. find / -name "*log4j*" 2>/dev/null Here's the output that indicates that Xcode has ...
user avatar
  • 101
1 vote
2 answers
176 views

How evil could an HDMI/VGA adapter be?

I recently bought a HDMI to VGA + Audio Out adapter on the internet for the purpose to playing Xbox on an old monitor. It came just inside a plastic bag, so I don't have any guarantees that the ...
user avatar
  • 757
34 votes
3 answers
18k views

Am I protected from Log4j vulnerability if I run Java 8u121 or newer?

According to the notes for CVE-2021-44228 at mitre.org: Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "...
user avatar
0 votes
0 answers
34 views

Local attack vector and other metrics

While calculating the CVSS score using CVSS3.1, attack vectors are classified into four. Network - Remote attack Adjacent - Should share the same Physical or Logical network of victim Physical - ...
user avatar
3 votes
1 answer
471 views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
user avatar
  • 271
4 votes
1 answer
1k views

How to validate if Log4Shell patch is applied?

Is it enough to upgrade log4j-core and log4j-api to 2.15.0 but leave log4j-slf4j-impl, which is a binding library, to 2.14.1, given that mvn dependency:tree suggests that log4j-slf4j-impl:2.14.1 is ...
user avatar
  • 143
86 votes
3 answers
36k views

Does CVE-2021-44228 impact Log4j ports?

Log4j has been ported to other languages, such as log4perl, log4php, log4net, and log4r. Are these ports vulnerable to CVE-2021-44228 as well? I believe that they aren't because the vulnerability uses ...
user avatar
  • 2,432
0 votes
3 answers
188 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
user avatar
  • 312
10 votes
2 answers
2k views

Does CVE-2021-42694 affect only compiled code?

A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0. Does it only affect code compiled from sources with disallowed unicode characters? RHEL ...
user avatar
  • 1,457
0 votes
2 answers
127 views

Are there any further security considerations when joining a public wifi network other than firewall and anti-virus?

If I use my laptop on my company wifi network to use the internet, what access has the company to the laptop hard drive and information on it? The company wifi is there for customers and employees (...
user avatar
  • 1
1 vote
1 answer
101 views

TOCTOU (Time-of-check to time-of-use) possible without file system access?

I'm wondering if it's possible to exploit a TOCTOU vulnerability without having local access to file systems? For example, in the context of a user uploading a file to a webserver, is this timing ...
user avatar
0 votes
0 answers
55 views

Unknown vulnerability name Referer header and Access-Control-Allow-Origin

When reviewing an application, I saw the "Access-Control-Allow-Origin" header as a response. When I modified the "Origin" header in the request, I got a 404, which was fine. So no ...
user avatar
4 votes
1 answer
306 views

Does using view page source on a possibly malicious site carry any real risks?

As far as I know, View page source does not execute any JavaScript, but is that good enough? Could there in theory be any vulnerabilities in the HTML parser or something similar? Have there been any ...
user avatar
0 votes
0 answers
55 views

Was rails issue ever fixed - Unsafe Query Risk in Active Record?

I was trying to figure out whether this issue has ever been fixed in Rails but my searches yielded nothing. A vulnerable application will either contain columns named identically to their table, or ...
user avatar
0 votes
1 answer
86 views

How to use pre-existing threat catalogue to determine if a certain system is vulnerable?

There are many risk assessment guidelines such NIST800-30 and ISO 27005 that provide a catalogue of known threats as reference. Using a qualitative approach, I selected one threat events catalogue and ...
user avatar
  • 1
0 votes
0 answers
112 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
user avatar
1 vote
2 answers
183 views

How common are firmware infections?

Hard drive firmware infections were documented in 2015: The hacking tool, believed to be a product of the NSA, is significant because subverting the firmware gives the attackers God-like control of ...
user avatar
  • 312
1 vote
2 answers
232 views

How to detect weak SSH keys affected by CVE-2021-41117

Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
user avatar
  • 111

1
2 3 4 5
20