Questions tagged [vulnerability]
A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.
1,018
questions
1
vote
0
answers
39
views
Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?
I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
- 11
24
votes
3
answers
5k
views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 343
0
votes
2
answers
120
views
Kernel level attack?
In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the ...
- 101
0
votes
2
answers
131
views
Mitigating vulnerabilities in audio libraries that cause physical damage
As I pointed out here in February 2022, people who gained brief direct or remote access to a machine can change the volume step or other things regarding sudden large changes to the sound volume (for ...
- 384
1
vote
4
answers
224
views
GPS metadata in uploaded pictures: vulnerability or not?
If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? Why? And would it be ...
- 15.7k
0
votes
0
answers
77
views
How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?
I'm a beginner bug bounty hunter, and I recently came across a Self-XSS vulnerability during my security testing on a target website. The vulnerability occurs when I inject a payload into the X-...
0
votes
0
answers
63
views
HSM Thales PayShield vulnerabilities
My management requested to investigate about security of HSM Thales Payshield.
Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
- 11
0
votes
0
answers
39
views
How to reproduce this CVE-2020-7774 parameter pollution vulnerability
While pentesting a website I came across yarn.lock file that contains an application dependency and I found this vulnerable library y18n v4.0.0 to CVE-2020-7774.
How can I reproduce the vulnerability ...
- 1
0
votes
0
answers
29
views
Bank employees asked random 2 characters of password during verification! [duplicate]
Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line?
They said me that it is verification procedure but I am not sure it ...
0
votes
0
answers
55
views
Is there any increase to known security risks by mounting the EFI System Partition, on a Windows 10 PC?
Security risks, as in malware, attackers, or known vulnerabilities.
Threats while the ESP is mounted, or after unmounting. E.g. Could it open access routes for future attackers. I aim to avoid ...
- 1
0
votes
1
answer
126
views
What to do if a bank doesn't admit it leaked millions of customer's data [closed]
I found a breach on a bank's website a few months ago which exposed customer data including: SSNs, account numbers, account balances, physical addresses, payment history, tax forms, temporary login ...
- 3
2
votes
0
answers
70
views
Why are certain hashes missing from the .git objects folder?
I'm currently attempting to pentest a web application created by a relation, who wanted me to find vulnerabilities and to let him know what exploits would be possible with said vulnerabilities.
I have ...
- 21
0
votes
1
answer
55
views
Does the presence of an "unsafe" function in an object file pose a security risk
I've read that there are unsafe functions that we should try to avoid when writing C/C++ programs for example the gets() or strlen() functions.
Let's say I compile a .cpp/.c file into an object file ...
- 101
0
votes
1
answer
166
views
Bypassing root detection qualify as a vulnerability?
I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways.
My main question is: ...
- 15
0
votes
1
answer
47
views
How can I get CISA weekly summary sorted by vendor rather than by CVE?
I subscribe to the CISA's weekly vulnerability summary email.
This USED to come sorted by vendor/product, so I could quickly skip over the Cisco and Wordpress vulnerabilities to check the stuff I care ...
0
votes
1
answer
101
views
Is the vulnerability reporting to our website actually a scam? [closed]
An individual contacted us claiming that he discovered vulnerabilities in our website. He also showed his intention to show us detailed information about the vulnerabilities, including how to ...
- 123
0
votes
0
answers
82
views
Possible authentication vulnerability, is it an issue?
I have found an interesting bug (?), but I'm not sure if it is an actual vulnerability.
Let's assume we have target, A, user, B, and 3rd party auth provider, C.
User B signs up with target A with ...
- 101
1
vote
1
answer
323
views
CVSS3 Scope change question
Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
- 85
0
votes
1
answer
59
views
Covert channel definition conflicts regarding steganography
I'm under the impression that stegonographic manipulation of file names or packet timing would qualify as a storage covert channel and a timing covert channel respectively.
I came across this ...
- 1
1
vote
2
answers
224
views
Coverity flags as unsafe deserialisaton. Is this vulnerable?
Coverity shows the block of code as unsafe deserialization:
String str = OBJECT_MAPPER.writeValueAsString(body); //Body is user controlled
Ferarri myclassobj = OBJECT_MAPPER.readValue(str, Ferarri....
- 43
2
votes
0
answers
112
views
Is a mobile phone number in itself an information that can be utilized by hackers etc? [duplicate]
I recently installed Tinder, and I saw that the app warns about sharing your phone number to avoid being hacked.
I also noticed certain obviously fake profiles pressing for getting a phone number or ...
- 121
0
votes
1
answer
445
views
CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API
I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
- 1
2
votes
1
answer
200
views
Is running rsync as root problematic?
Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du?
Background:
I'm moving data from various systems ...
- 21
0
votes
1
answer
90
views
Filter CVEs by affected OS
Is it possible to filter CVEs by affected platform/OS?
Some sources do provide this, like exploit-db, but the main vulnerability source NVD, National Vulnerability Database, doesn't seem to have such ...
- 1
1
vote
0
answers
230
views
Am I exploitable to CVE-2023-20862?
I am trying to analyze whether I am exploitable to the new CVE in spring security.
As per Spring they mention the following:
Specifically, an application is vulnerable when any of the following is ...
20
votes
4
answers
5k
views
Is a responsible disclosure for hardware-based vulnerabilities even possible?
In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might ...
- 311
1
vote
2
answers
73
views
Windows controlled folder access to secure Chrome cookies?
I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel.
Is this preventable with Windows controlled folder access (preventing apps ...
- 111
0
votes
1
answer
95
views
Difference Between Exploit Kits Vs. Probing a Network for Vulnerabilities
I don’t understand exactly the difference between websites using exploit kits on visiting users vs. a website server probing a network for vulnerabilities and then exploiting them.
The scenario is ...
0
votes
0
answers
29
views
How to proceed once your machine has been infected? [duplicate]
I have a Windows 10 machine. Around a week ago, someone was able to purchase stuff using my credit card, before I was able to lock my card. For a few weeks before then, I'd noticed that my computer ...
- 1
1
vote
0
answers
122
views
Check if a Maven dependency has CVEs without having to include it in my project
In our project, we are using OWASP dependency checks to check whether a dependency has vulnerabilities or not.
How can we check if a given Maven package has a known vulnerability?
I do not want to ...
- 111
1
vote
0
answers
37
views
Required features for taint-based vulnerability tools? [closed]
What tools are necessary for static-analysis taint-based vulnerability detection? For example, being able to find/search source-sink paths through a tainted variable, flexibility to choose flow ...
- 11
1
vote
1
answer
233
views
ICMP timestamp - firewall configured to drop timestamp request, but vulnerability scanner can send request and get a response
We use an external scanner (Qualys) to scan our external assets. We have a firewall in front of the external assets, but it is configured to whitelist the scanner so that the external assets get ...
- 11
1
vote
1
answer
143
views
Does downstream software that inherits vulnerable code need its own CVE submission?
A vulnerability could spread from one software to downstream software projects that import/use the software. If the original software has already requested a CVE ID and disclosed the vulnerability to ...
- 21
0
votes
1
answer
57
views
Post-EOL security patches for PHP7
Imagine the following situation: you have a third party software which still uses PHP7 despite of the EOL.
The risk there will be further post-EOL vulnerabilities is as I estimated considerably higher ...
- 127
1
vote
0
answers
137
views
Why was CVE-2022-20411 (Bluetooth Remote Code Execution) not detected by Android's BoundSanitizer?
CVE-2022-20411 enabled remote code execution over Bluetooth on Android. It was fixed in December 2022. But why was it not detected by Android's BoundsSanitizer?
Its purpose is to detect and prevent ...
- 111
0
votes
1
answer
172
views
Vulnerability in the source code, but can't elevate do Privilege Escalation
Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
- 11
0
votes
3
answers
74
views
Analyze fixed vulnerabilities in software updates
Developers update their software, sometimes they patch vulnerabilities.
Is it realistically possible to analyze the updated code (even if it's closed source) to find the vulnerability that has been ...
- 1
0
votes
1
answer
102
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
- 1
1
vote
0
answers
173
views
Different results for CPE search on NVD
I usually stick to finding the right CPE candidate for product-version I am interested in by using the Search Vulnerability Database with Search Type selected as Advanced and then narrowing down from ...
- 195
5
votes
3
answers
3k
views
Why/When does patching CVE-2022-41099 (BitLocker Bypass) require extra steps?
Microsoft has published information about a recent security problem classified as "BitLocker Security Feature Bypass" identified as CVE-2022-41099 which points out that Windows Recovery ...
- 51
0
votes
1
answer
81
views
What are the security issues of being able to put anything into a website's URL and generate a 200 status code?
If I have a website where a user can add any string into the URL after the domain and have it return a 200 status code rather than 404, what are the security implications?
Is this something that can ...
- 1
0
votes
1
answer
246
views
Can my infected phone’s hotspot infect my outdated computer?
Knowing that anything is possible for the many ways a hacker can break into a system, is it also possible that if I have an infected phone acting as a hotspot, my outdated computer could get infected ...
1
vote
0
answers
43
views
Code with BoF that cannot be detected by symbolic execution
I am having troubles finding and understanding when symbolic execution fail.
From my understanding tools like PathCrawler use symbolic execution. I gave it this code:
#include <stdio.h>
#include ...
0
votes
2
answers
416
views
A DNS that has been eliminated is still resulting in X.509 Certificate Subject CN Does Not Match the Entity Name
I ran a Nexpose scan on a DNS that no longer resolves and a vulnerability was found : X.509 Certificate Subject CN Does Not Match the Entity Name
I don't know why it's still producing a vulnerability ...
2
votes
5
answers
2k
views
Session regeneration after password change?
So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
- 21
0
votes
1
answer
142
views
Vulnerable Components CVSS Score
How do you map vulnerable components' CVSS scores?
Do you use the CVE CVSS score? Do you calculate again?
For example: A host is using a component that has a CVE for a high vulnerability.
Do you ...
- 1
1
vote
1
answer
148
views
Is it considered a security vulnerability if it is possible to buy things for free in an online shop?
Let's imagine the following:
There is a web shop and they have a 5$ off coupon code. The intention is that you can use this code only once. But it is possible to use it multiple times so you can buy ...
- 145
0
votes
0
answers
24
views
How do I report that the organization is using common passwords for the backend [duplicate]
I was surfing on a big company's website, and I tried to make an account on it. I found that the account registration was quite buggy so I checked the page source. I found that there were error logs ...
- 101
1
vote
0
answers
602
views
Changing referer value in burp request has no impact on the response
I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response.
The Referer contains the URL along with the unique ID of ...
- 23
1
vote
1
answer
442
views
Can we set a custom CSRF token inside header requests to make a CSRF PoC?
I'm trying to create a PoC for a CSRF issue I found. The request contains the CSRF token inside the request header and the problem is that the server side is checking only if the token is available ...
- 13