Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

1
vote
0answers
28 views

Android Exploit Development Lab [on hold]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
7
votes
1answer
99 views

What is the reason for the increase of CVEs since 2017?

According to CVEdetails.com, there were 6447 CVEs in 2016. In 2017 there were 14714 CVEs. That's 128% more than in 2016. Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
34 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
9
votes
1answer
521 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
1
vote
2answers
172 views

How does an OS execute code from a PNG file? [duplicate]

A recent bug in Android allows a hacker to execute code that is contained within an image file. Here is the quote from the Android Security Bulletin, The most severe vulnerability in this section ...
0
votes
1answer
67 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
0
votes
1answer
41 views

OAuth 2.0 when and how to use the client id and secret

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
1answer
43 views

is SSRF attack or vulnerability?

I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?
0
votes
1answer
18 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
1
vote
2answers
127 views

Vulnerability in using `input type=“text”` for website password other than shoulder surfing

I found a website that uses the plain text field as a password input form. <input type = "text" autocomplete= off ...> I understand shoulder surfing is one vulnerability but are there other ...
0
votes
0answers
15 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
4
votes
2answers
236 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
1answer
60 views

How to do Mobile application testing using Burp Suite on latest ios and android devices

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices. Here are the settings below which I have done in below points. I made sure that my ...
-1
votes
1answer
41 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
1
vote
1answer
39 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
2
votes
1answer
118 views

How does wireless keyboards' encryption prevent frequency analysis?

I've found very little information on this topic after much googling. The only partial answer I found was by Microsoft: Microsoft_AES_Technical_Factsheet By adding random data to each message, each ...
2
votes
0answers
41 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
1
vote
1answer
45 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
2
votes
1answer
158 views

Do security consultants routinely demonstrate hacking into attendees' PCs within minutes?

From this Quora answer: Years ago when I was in China I was getting updated on cyber security from one of our partnerships. We were going over everything from basic hacks a 9 year old could ...
3
votes
1answer
66 views

Do memory-level vulnerabilities in x86 applications also affect ARM?

I am currently fuzzing various open-source libraries and programs in order to find buffer overflows, underruns, memory leaks, crashes, etc. I am using an ARM system to perform this fuzzing. The ...
2
votes
0answers
28 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
0
votes
0answers
62 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
1
vote
3answers
138 views

Router access, am I in danger?

I learned I can access my router from a web device like so http://ipaddress/login.html I was wondering if anyone could gain access to my router control panel. IF that is the case can they compromise ...
1
vote
1answer
84 views

Exploit database for NVD vulnerabilities [closed]

I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
1
vote
0answers
16 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
3
votes
4answers
181 views

Is there a standard for labeling a vulnerability as an intentional backdoor?

US concerns of intentional vulnerabilities placed in foreign manufactured equipment has lit up headlines. Is there a standard that sorts (differentiates) poor-designs from intentionally placed ...
1
vote
2answers
37 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
96 views

Internal HTTP(s) vulnerabilities

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
1
vote
0answers
45 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
0
votes
1answer
70 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
2
votes
3answers
359 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
2
votes
1answer
112 views

How long to wait before publishing a web vulnerability?

I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several ...
2
votes
1answer
64 views

envelope encryption (using KMS) vs ECDH

at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the ...
0
votes
2answers
157 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
13
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
2
votes
0answers
172 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
2
votes
1answer
54 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
0
votes
2answers
93 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
0
votes
1answer
209 views

Reverse Shell Exploit for SquirrelMail 1.4.22 [closed]

I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is ...
0
votes
1answer
125 views

What famous attacks used a use-after-free vulnerability?

I'm compiling vulnerabilities and related attacks, and I need to find a famous attack that exploited a use-after-free vulnerability. I've looked for a while though I can't seem to find any. I know ...
1
vote
1answer
205 views

Default or Guessable SNMP community names: public

We have detected "Default or Guessable SNMP community names: public" vulnerability in one of our printer through Nexpose. The remediation states we have to secure SNMP installation. What does it mean ...
0
votes
1answer
96 views

Could an Smart TV be a threat for a hotel?

After some research I found that a Smart TV which is connected on the Internet could be vulnerable to threats such as monitoring, taking control of the tv etc. I wonder if a Smart TV which is used by ...
0
votes
2answers
118 views

How to search for all computers running memcached on shodan

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port ...
1
vote
2answers
60 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
2answers
149 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
3
votes
1answer
902 views

How did a bug like CVE-2018-10933 (libssh authentication bypass) happen?

How did a bug like the recent libssh vulnerability come to exist? Exactly what is the nature and root cause of the bug? From libssh's website: libssh versions 0.6 and above have an authentication ...
70
votes
3answers
28k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
2
votes
1answer
248 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
0
votes
1answer
44 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
1answer
313 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....