Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
1answer
54 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
0
votes
0answers
44 views

Differentiating bugs from vulnerabilities and extracting vulnerabilities from GitHub issue reports

I am performing an empirical study on deep learning libraries and therefore have collected issue reports from these deep learning libraries on GitHub. PyTorch, Keras, Caffe,scikit-learn, ApacheMXNet, ...
0
votes
0answers
47 views

Mimicking TOCTOU in Go

I'm trying to simulate a race condition in Go to replicate a time-of-check time-of-use vulnerability (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use). The code below takes in a user-...
2
votes
1answer
131 views

How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
1
vote
1answer
75 views

Some random string is appended prefixed by a DOT at the end of URL

Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows. The request URL which our ...
0
votes
2answers
97 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
0
votes
2answers
103 views

Manually Validating Vulnerabilities from a Vulnerability Scan

How do you manually validate vulnerabilities from a vulnerability scan or a vulnerability release from a vendor? Say you received a report with a high vulnerability. The vulnerability scanner used a ...
0
votes
1answer
167 views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
0
votes
0answers
52 views

Can Chrome's HTTP HEAD requests be misused to launch an attack?

When I used Chrome today via Burp, I noted that, apart from the tracking requests, three random HTTP HEAD requests are sent each time I open the browser. I already found How to find a process that is ...
0
votes
0answers
39 views

What could be the potential vulnerabilities and threats in endpoint encrypted file storage system?

Consider the following scenario: Client installs a web API based endpoint encryption software. They upload the endpoint encrypted files to the server with the following format by using poly1305 and ...
0
votes
3answers
55 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
0
votes
0answers
36 views

Can Software-based fault isolation (SFI) prevent meltdown?

Suppose we have a complete implementation of SFI on a CPU hardware that is vulnerable to meltdown attacks that also happens to run a Linux kernel that is also vulnerable to meltdown attacks. Can SFI ...
1
vote
0answers
70 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
2
votes
2answers
191 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
0
votes
2answers
101 views

Can vulnerabilities in libraries cause security problems in user-level binaries?

https://trailofbits.github.io/ctf/vulnerabilities/source.html It says "Common examples include libraries like libxml, libpng, libpoppler, and libfreetype that parse complicated file formats and ...
0
votes
0answers
31 views

What is the nature of vulnerabilities in JS modules used client-side?

When installing JavaScript modules, I sometimes see that some of them have security vulnerabilities. It made me wonder about the kind of vulnerabilities this could be, and how they could be exploited ...
5
votes
2answers
760 views

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE. We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
3
votes
0answers
70 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
1
vote
0answers
36 views

Crowdstrike Sensors - Do they need inbound, as well as outbound access? [closed]

As per the title, I'm looking for insight on the crowdstrike sensor. Does anyone know if, on top of the outbound pt:443 access to the domains it requires, whether it also requires inbound connectivity?...
2
votes
1answer
142 views

vulnerability management 101

Looking at a typical vulnerability scan report from Nessus or Qualys most people are terrified, lost, and basically with more questions than answers. For example, how on earth am I going to deal with ...
2
votes
1answer
49 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
65 views

Is rsyncd secure? (except for the lack of transport encryption)

I have been using an rsyncd server for backups for what feels like a decade. I saw that rsyncd has no transport encryption (not even for username and password). I wonder what other security issues ...
0
votes
2answers
125 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
1
vote
1answer
89 views

CGI-BIN - suspicious activity (unknown IP made request)

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...
0
votes
1answer
46 views

How to handle as a Tester if the website is kicking out the user for recreating the session?

Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! ...
5
votes
1answer
1k views

Does “emergency mode” help protect iOS devices in AFU mode?

In recent iOS devices you can temporarily disable unlocking via biometrics by holding the power button and either volume button for a couple seconds. I’m trying to find out if this does anything to ...
0
votes
0answers
35 views

Is there an analysis/whitepaper out there regarding RCE with ICMP Echos against windows hosts?

I know this might sound silly but given what happened with SIGRed I wanted to ask and see what those who know think: Is there an audit or analysis out there showing the possibility of RCE with ICMP ...
3
votes
3answers
1k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
1
vote
0answers
43 views

Is it ok to give the client the power to make any request from within our server?

We have a very heavy endpoint on our server, that takes a few hours to respond. Of course, this would result in a timeout, so we added an "asynchronous" functionality to it. To summarize, a ...
1
vote
1answer
121 views

What are criteria and rules to determine bug bounty amounts? [closed]

How is the reward amount determined on different bug bounty platforms like Bugcrowd, HackerOne or Synack? As a bug bounty program owner I can maybe define some rules for the rewards. What are the ...
2
votes
0answers
49 views

Zip Slip path traversal and consistent vulnerability checks

According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory: String ...
1
vote
1answer
119 views

Vulnerabilities for multiple kernel versions that are installed on a given server

As per Exclude or display vulnerabilities for non-running Linux kernels : It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on ...
0
votes
0answers
77 views

How long does a HiddenEye keylogger script last in an Android browser?

I recently clicked on a phishing link and entered my credentials but then I changed the password. I believe the phisher used HiddenEye with a keylogger script in the webpage so how long can he capture ...
0
votes
2answers
98 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
2
votes
1answer
100 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
-2
votes
1answer
179 views

Nexpose Vulnerability scanner

Is it normal to get 3000+ vulnerabilities while scanning server using Nexpose? Or I can reduce the vulnerability to decent count by some tweaks!
4
votes
0answers
127 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
4
votes
2answers
231 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
0
votes
0answers
54 views

Is malware in an EC firmware a concern, when standard security is in place together with the rest of the computer having no malevolent tampering?

Question My question is whether malware in the embedded-controller firmware is something to worry about if the rest of the computer system is faithfully what it should be, together with standard ...
0
votes
1answer
42 views

can vulnerabilities be treated differently based on ceratin circumstances? [duplicate]

We are running vulnerability scans on our systems. I can see a few XSS vulnerabilities being reported, such as CVE-2020-14173. Let me quote: The file upload feature in Atlassian Jira Server and Data ...
1
vote
0answers
65 views

Remote file inclusion (RFI) found - vulnerability or false positive?

For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
90
votes
6answers
14k views

Why does my IT department block Firefox?

We received a message from the IT bods this week stating: Summary of the issue: IT will disabling and blocking the use of the browser Firefox next Thursday the 03.12.20 on all IT managed devices. Due ...
3
votes
1answer
534 views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
3
votes
2answers
138 views

How to estimate threat and risk associated with that threat and not only vulnerability severity?

Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part. I ...
3
votes
0answers
86 views

Can/should I automatically report network break-in attempts?

For the last 15 years I've been using SpamCop to report the spam I receive. I do this because it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
0
votes
1answer
69 views

Using outdated ADSL modem with up to date router - Security Concerns

My parents live way out in the middle of nowhere. The only service provider that is not satellite is Century Link, which uses ADSL / phone lines. They wanted me to set them up, and the service guy was ...
1
vote
1answer
113 views

Is it possible for a self-extracting file to run malware on Linux?

I know that you need to change permissions for a file to run as a script on Linux. Is that enough to prevent any malware from being installed by some self-extracting file? Is there anything that can ...
0
votes
1answer
297 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
1
vote
1answer
512 views

Can string concatenation in file_get_contents() be exploited in PHP?

Let's say I have the following PHP code: <?php echo file_get_contents($_GET['path'] . ".txt"); Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
0
votes
1answer
81 views

Is it possible for someone to make a purposefully vulnerable site then take advantage of that vulnerability to hack the users?

Is it possible for someone to make a purposefully vulnerable site then lure users to his site where he then takes advantage of that vulnerability to hack their social media accounts etc? If so how?

1
2 3 4 5
19