Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
-1
votes
1answer
47 views

How to take advantage of a new security tool (SCA) added to company?

We recently added a new Software Component Analysis tool (dependencytrack) to our infrastructure, which allows us to gain visibility on which dependencies are pulled by the code of our web apps. How ...
0
votes
3answers
110 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
10
votes
1answer
2k views

Does CVE-2021-42694 affect only compiled code?

A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0. Does it only affect code compiled from sources with disallowed unicode characters? RHEL ...
0
votes
1answer
53 views

Are there any further security considerations when joining a public wifi network other than firewall and anti-virus?

If I use my laptop on my company wifi network to use the internet, what access has the company to the laptop hard drive and information on it? The company wifi is there for customers and employees (...
1
vote
1answer
51 views

TOCTOU (Time-of-check to time-of-use) possible without file system access?

I'm wondering if it's possible to exploit a TOCTOU vulnerability without having local access to file systems? For example, in the context of a user uploading a file to a webserver, is this timing ...
0
votes
0answers
26 views

Unknown vulnerability name Referer header and Access-Control-Allow-Origin

When reviewing an application, I saw the "Access-Control-Allow-Origin" header as a response. When I modified the "Origin" header in the request, I got a 404, which was fine. So no ...
4
votes
1answer
263 views

Does using view page source on a possibly malicious site carry any real risks?

As far as I know, View page source does not execute any JavaScript, but is that good enough? Could there in theory be any vulnerabilities in the HTML parser or something similar? Have there been any ...
0
votes
0answers
28 views

Was rails issue ever fixed - Unsafe Query Risk in Active Record?

I was trying to figure out whether this issue has ever been fixed in Rails but my searches yielded nothing. A vulnerable application will either contain columns named identically to their table, or ...
0
votes
1answer
44 views

How to use pre-existing threat catalogue to determine if a certain system is vulnerable?

There are many risk assessment guidelines such NIST800-30 and ISO 27005 that provide a catalogue of known threats as reference. Using a qualitative approach, I selected one threat events catalogue and ...
0
votes
0answers
58 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
0
votes
1answer
101 views

How common are firmware infections?

Hard drive firmware infections were documented in 2015: The hacking tool, believed to be a product of the NSA, is significant because subverting the firmware gives the attackers God-like control of ...
1
vote
2answers
104 views

How to detect weak SSH keys affected by CVE-2021-41117

Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
0
votes
0answers
42 views

Ignore blacklist characters and keywords in SSTI exploit payload

I'm exploiting an SSTI (server-side template insertion) vulnerability in a website written in flask-python. My problem is that payload for RCE is being limited by blacklist. I tried everything with a ...
4
votes
2answers
296 views

Are devDependencies in Node.js exploitable?

I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency. But from a research prospective, I want to know ...
0
votes
2answers
52 views

What is a source maps vulnerability?

I was wondering if any can simplify the source maps vulnerability?. I've googled this vulnerability but can't get my head around this. Could anyone please help me to understand this issue and how do I ...
0
votes
0answers
44 views

Snyk auth without internet access

I would like to run snyk on machine without internet access, but first step is to authenticate with Snyk account. Is it possible to do this without internet access? Unfortunately both commands snyk ...
-1
votes
1answer
66 views

Ubuntu CVE Score - Gained acces level:None - Does it mean personal data is safe on ubuntu?

I was studying the following page listing all the vulnerabilities of ubuntu. CVE Ubuntu What I found surprising is that all vulnerabilities report that "gained access level: None". Does that ...
0
votes
2answers
108 views

Importance of OS security patches for devices only used in home network

(This question bugs me because I am not willing to upgrade for Windows 10) If we are talking about a device (i.e. a PC) in the following scenario: The device is located behind a router that is up-to-...
0
votes
1answer
141 views

Why Vulnerability Scanners Ignore Shared Libraries?

First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
0
votes
0answers
126 views

What is google recommendation to fix the task hijacking issue

Applications running on android devices below 10 are vulnerable to task hijacking. Even though the issue is fixed from android 11 and above, we cannot tell our customers to upgrade the android version ...
0
votes
1answer
98 views

How to prevent attacks due to Insufficient Logging & Monitoring?

A10:2017-Insufficient Logging & Monitoring This is one of OWASP Top 10 vulnerabilities. Given that we log and monitor sufficiently, how can this prevent an attack for example - attack where ...
2
votes
1answer
175 views

What does Snowden mean by "majority of vulnerabilities ... are introduced, for technical reasons ..., at the exact time the code is written"?

In a recent Substack article ("The Insecurity Industry", 2021-07-26) Edward Snowden writes: The vast majority of vulnerabilities that are later discovered and exploited by the Insecurity ...
1
vote
1answer
81 views

How does Sequoia allow unprivileged users to get root if it requires mounting a filesystem?

CVE-2021-33909 AKA "Sequoia" is a vulnerability against the filesystem code within the Linux kernel. According to the description of the vulnerability from Qualys Successful exploitation of ...
1
vote
1answer
116 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
0
votes
0answers
57 views

Differentiating bugs from vulnerabilities and extracting vulnerabilities from GitHub issue reports

I am performing an empirical study on deep learning libraries and therefore have collected issue reports from these deep learning libraries on GitHub. PyTorch, Keras, Caffe,scikit-learn, ApacheMXNet, ...
0
votes
0answers
62 views

Mimicking TOCTOU in Go

I'm trying to simulate a race condition in Go to replicate a time-of-check time-of-use vulnerability (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use). The code below takes in a user-...
2
votes
1answer
176 views

How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
1
vote
1answer
99 views

Some random string is appended prefixed by a DOT at the end of URL

Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows. The request URL which our ...
0
votes
2answers
123 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
0
votes
2answers
212 views

Manually Validating Vulnerabilities from a Vulnerability Scan

How do you manually validate vulnerabilities from a vulnerability scan or a vulnerability release from a vendor? Say you received a report with a high vulnerability. The vulnerability scanner used a ...
1
vote
1answer
777 views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
0
votes
0answers
68 views

Can Chrome's HTTP HEAD requests be misused to launch an attack?

When I used Chrome today via Burp, I noted that, apart from the tracking requests, three random HTTP HEAD requests are sent each time I open the browser. I already found How to find a process that is ...
0
votes
3answers
78 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
0
votes
0answers
50 views

Can Software-based fault isolation (SFI) prevent meltdown?

Suppose we have a complete implementation of SFI on a CPU hardware that is vulnerable to meltdown attacks that also happens to run a Linux kernel that is also vulnerable to meltdown attacks. Can SFI ...
1
vote
0answers
86 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
2
votes
2answers
581 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
0
votes
2answers
113 views

Can vulnerabilities in libraries cause security problems in user-level binaries?

https://trailofbits.github.io/ctf/vulnerabilities/source.html It says "Common examples include libraries like libxml, libpng, libpoppler, and libfreetype that parse complicated file formats and ...
0
votes
0answers
45 views

What is the nature of vulnerabilities in JS modules used client-side?

When installing JavaScript modules, I sometimes see that some of them have security vulnerabilities. It made me wonder about the kind of vulnerabilities this could be, and how they could be exploited ...
5
votes
2answers
791 views

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE. We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
3
votes
0answers
82 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
1
vote
0answers
47 views

Crowdstrike Sensors - Do they need inbound, as well as outbound access? [closed]

As per the title, I'm looking for insight on the crowdstrike sensor. Does anyone know if, on top of the outbound pt:443 access to the domains it requires, whether it also requires inbound connectivity?...
2
votes
1answer
164 views

vulnerability management 101

Looking at a typical vulnerability scan report from Nessus or Qualys most people are terrified, lost, and basically with more questions than answers. For example, how on earth am I going to deal with ...
2
votes
1answer
69 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
89 views

Is rsyncd secure? (except for the lack of transport encryption)

I have been using an rsyncd server for backups for what feels like a decade. I saw that rsyncd has no transport encryption (not even for username and password). I wonder what other security issues ...
0
votes
2answers
153 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
1
vote
1answer
110 views

CGI-BIN - suspicious activity (unknown IP made request)

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...
0
votes
1answer
56 views

How to handle as a Tester if the website is kicking out the user for recreating the session?

Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! ...
5
votes
1answer
1k views

Does “emergency mode” help protect iOS devices in AFU mode?

In recent iOS devices you can temporarily disable unlocking via biometrics by holding the power button and either volume button for a couple seconds. I’m trying to find out if this does anything to ...
0
votes
0answers
48 views

Is there an analysis/whitepaper out there regarding RCE with ICMP Echos against windows hosts?

I know this might sound silly but given what happened with SIGRed I wanted to ask and see what those who know think: Is there an audit or analysis out there showing the possibility of RCE with ICMP ...
3
votes
3answers
2k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...

1
2 3 4 5
19