Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
4answers
73 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
0
votes
1answer
71 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
1
vote
1answer
50 views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
1
vote
0answers
40 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
2
votes
1answer
99 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
2answers
38 views

Possible SSRF in image tag that takes (partial) user input?

A webapp has an img tag that partially takes userinput like so: <img src="/blah/blah/$USERINPUT.jpg"> where the first / is from the root of the domain. Could there be a vulnerability ...
1
vote
1answer
72 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
1answer
86 views

How can I tell if a program (in this case Jitsi Meet Electron) has bad-enough vulnerablities making it unsafe for current use and/or protect myself? [closed]

I'm uneasy that Jitsi Meet (videoconferencing stack) is Chrome-first (bug relating to other browsers are fixed later) and dislike Chrome for privacy reasons. Jitsi has an Electron desktop web-wrapper ...
0
votes
0answers
29 views

How to save .Net Application from TOCTOU [closed]

Just read about TOCTOU vulnerability and upon examinnig my application was doing the same as upon login all his roles are fetched then saved in session so that user will have access to all these roles ...
-1
votes
1answer
54 views

Is there any document that contains all web vulnerabilities of OWASP? [closed]

OWASP top 10 lists the top 10 web security risks. But I didn't find the other vulnerabilities out of the top 10 in OWASP site. Is there any document that contains all web vulnerabilities?
0
votes
1answer
62 views

Is there any authoritative classification of vulnerabilities?

Is there any classification of vulnerabilities ? As we know, there are many vulnerabilities, such as: SQL injection vulnerability, File upload vulnerability, File contains vulnerability, XSS, SSRF, ...
1
vote
1answer
112 views

Slow HTTP POST vulnerability in IIS 10

I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer. From what I understood from this finding, ...
0
votes
1answer
98 views

Are rich-client apps inherently more secure than webapps? [closed]

If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF ...
0
votes
1answer
42 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
1answer
48 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
0
votes
1answer
46 views

Booting 'live' form the hard disk

I use VeraCrypt for file-container level encryption for all of my files. But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
-1
votes
2answers
101 views

Can someone Inject malicious SQL to my SQL query? [closed]

I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID. Is there a way someone can Inject malicios ...
0
votes
1answer
75 views

What are the security risks of allowing users to add iframes?

In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags. I'd like to allow <iframe> so that users can insert youtube videos and so on. However I'm worried ...
1
vote
2answers
112 views

Are call stack addresses predictable with all protections disabled?

I'm currently practicing buffer overflows, but there is one thing I don't understand yet. I have read this similar question. I understand that if you don't know the address of ESP you must look for an ...
0
votes
1answer
56 views

Is it considered as a DOS attack if I add too much data to a page so that it doesn't respond at all?

I am working on an application. There is a new feature implemented where a user create some IDs and secret keys for that application. I have observed that there is no rate limit for creating those. I ...
1
vote
1answer
97 views

How to make use of a exploit that is not available in metasploit? [closed]

I want to exploit a Microsoft IIS HTTPD 10.0 server open which is open in PORT 80. However there is no available exploits in Metasploit but there are few vulnerabilities in this site. Is it possible ...
-1
votes
1answer
71 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
0
votes
2answers
92 views

Assigning static IP address other than 127.0.0.0/8 to loopback interface

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to ...
0
votes
0answers
57 views

How would you investigate if CoronaBlue has been exploited by an attacker or not?

How would you investigate if CVE-2020-0796 (Windows SMBv3 Client/Server Remote Code Execution Vulnerability) has been exploited by an attacker or not?
0
votes
1answer
198 views

How did I get hacked and what was accessed?

Two days ago I installed a new router. It was a new TPlink AC1900. I established a password for the web admin, went through the quick setup questions, changed the IP ranges for the DHCP service from ...
0
votes
1answer
218 views

ATM CVV1 + Service Code, POS Security Flaw?

I'm new to this topic and I found it very interesting how all the payment system is currently working. To be honest it look like they are not doing enough to stop fraudulent activity with Credit Cards....
0
votes
1answer
87 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
1
vote
2answers
435 views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
0
votes
0answers
43 views

Connecting to REST server w/ digest auth using postman

Im having a hard time with a CTF, i managed to exploit a path traversal vulnerability that lead me to read a configuration file in php that indicates: define('rest_auth', 'digest'); define('...
1
vote
0answers
55 views

What is this “prepare” variable used for in this SEH based buffer overflow payload?

I am trying to understand how a SEH based buffer overflow is working and I have to write a paper about how an exploit works. I took this PoC for my paper. junk = "\x41" * 4091 nseh = "\x61\x62" seh ...
1
vote
1answer
97 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
1
vote
4answers
208 views

What are the names of software vulnerabilities? [closed]

In web apps there are vulnerabilities like SQLi or XSS and many more. I heard that for hackers to hack a computer they have to find a vulnerability in a software that is running on an open port. ...
0
votes
0answers
116 views

Is SerializationException sign of Serialization/Deserialization vulnerability?

I am doing a bug bounty. I intercepted the POST request to the inscription in the target website. I modified the first name and last name POST params to inject bad char (in order to SQL inject) but ...
-1
votes
1answer
53 views

Bluetooth vulnerability on a Raspberry PI running Raspian

Is it possible for someone to exploit a Raspberry PI running Raspian through bluetooth just by having the bluetooth enabled?
2
votes
3answers
114 views

Need help on clarifying some pentesting concepts

Below are some conclusions I came up reading ebooks, blogs and tutorials about pentesting. I would like you to correct those conclusions if they are (all or partly) wrong. A vulnerability is any ...
62
votes
3answers
6k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
0
votes
0answers
56 views

Is document.write(window.location.hash.substr(1)) still exploitable for DOM XSS? [duplicate]

I stumbled upon Google's firing range for DOM XSS testing, and this case caught my eye: <script> var payload = window.location.hash.substr(1);document.write(payload); </script> As far ...
2
votes
4answers
172 views

Do video games on Windows have vulnerabilities?

You always hear about zero day vulnerabilities in Chrome, Skype, Zoom, Office, VLC, etc. But you never hear about vulnerabilities in video games (like popular multiplayer titles Fortnite or League of ...
1
vote
1answer
85 views

SQL vulnerable if input type = email check is enabled

<input type="email" class="form-control" name="email address" id="signinEmail" placeholder="Email address" aria-label="Email address" value="INPUT" required="" data-msg="Please enter a valid email ...
0
votes
2answers
75 views

Can demo exploits/attacks be run on desktop applications? [closed]

Are there any applications/tools for exploiting desktop applications? (with pre-built exploits) I'd like to test my Java desktop app for security. I've looked at tools like Metasploit, but they seem ...
0
votes
2answers
368 views

Installing xampp on virtual box?

I started learning PHP and I wanted to practice PHP code using xampp or wamp server. But after reading this and doing some google research,I thought that installing server software on my home pc ...
55
votes
7answers
12k views

Is this email asking me to sent them $100 for details on a security flaw in my website a scam?

I've just received this email. Is it a standard practice or a scam? I'm a Security Researcher running a vulnerability identification service for a small group of private clients, and I ...
1
vote
1answer
88 views

CVE-2020-5250 php vulnerability analysis

I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...
0
votes
0answers
91 views

Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?

My team and I have written a web app, and we had a bug report regarding a DoS vulnerability. This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
0
votes
1answer
101 views

Flash Vulnerabilities

What type of risks do I expose myself to by enabling flash in the browser? Web developers or online game developers who can use those vulnerabilities to crash my computer or exploit it by downloading ...
-3
votes
1answer
171 views

I found a security vulnerability in a web app developed by my university. Can it have a CVE number?

I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University. Using it I can get ...
0
votes
0answers
85 views

PadBuster Block Size check

After a small nikto scan I found a potential MS10-070 vulnerability on my server and while testing for the padding attack on the Padbuster tool, and after watching some exploits on youtube, I always ...
0
votes
0answers
167 views

Someone is Cryptomining from my Google Compute Engine Instance

I run an airflow instance which python process scheduler, which is used to trigger different python ML process which has no relation to crypto mining. This is the process which is running this ...
7
votes
2answers
2k views

Is it safe to send sensitive data in the post body to an azure function?

We want our users to send us a post request to an Azure Function endpoint. Is storing sensitive data (such as connectionstrings or passwords) in the post request body going to be an issue? Any insight ...
-1
votes
1answer
104 views

Is this domain vulnerable to XSS attack

I have a domain which when opened shows : Whatever I type after xyz.com/whatever appears on the title bar as xyz.com/whatever , if i write xyz.com/stackoverflow the title bar shows the same as xyz....

1
2 3 4 5
18