Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Vulnerabilities in Lorawan authentication [closed]

i'm reasearching some best practices in authentication techniques for IoT enabled environemnts and i'm looking for vulnerabilities in well-known protocols. About LoraWan i've read that we have 2 main ...
0
votes
0answers
44 views

Vulnerabilities in BLE Mesh authentication [closed]

I'm writing a thesis on authentication methods for IoT and I'm studying the BLE Mesh authentication scheme. We have Output OOB, Input OOB, Static OOB, No OOB for exchanging the randomly generated ...
1
vote
1answer
71 views

How to make use of a exploit that is not available in metasploit? [closed]

I want to exploit a Microsoft IIS HTTPD 10.0 server open which is open in PORT 80. However there is no available exploits in Metasploit but there are few vulnerabilities in this site. Is it possible ...
-1
votes
1answer
67 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
0
votes
2answers
74 views

Assigning static IP address other than 127.0.0.0/8 to loopback interface

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to ...
0
votes
0answers
36 views

How can I stay safe when I'm visiting potentially harmful websites on Android 9.0+ or similar MIUI? [closed]

I mean harmful by the fact that they might have ads, popups or other ways in which they might transfer malware to my phone or exploit vulnerabilities. And by visiting I mean interacting, clicking on ...
0
votes
0answers
44 views

How would you investigate if CoronaBlue has been exploited by an attacker or not?

How would you investigate if CVE-2020-0796 (Windows SMBv3 Client/Server Remote Code Execution Vulnerability) has been exploited by an attacker or not?
0
votes
1answer
185 views

How did I get hacked and what was accessed?

Two days ago I installed a new router. It was a new TPlink AC1900. I established a password for the web admin, went through the quick setup questions, changed the IP ranges for the DHCP service from ...
0
votes
1answer
115 views

ATM CVV1 + Service Code, POS Security Flaw?

I'm new to this topic and I found it very interesting how all the payment system is currently working. To be honest it look like they are not doing enough to stop fraudulent activity with Credit Cards....
0
votes
1answer
62 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
1
vote
2answers
146 views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
0
votes
0answers
42 views

Connecting to REST server w/ digest auth using postman

Im having a hard time with a CTF, i managed to exploit a path traversal vulnerability that lead me to read a configuration file in php that indicates: define('rest_auth', 'digest'); define('...
1
vote
0answers
50 views

What is this “prepare” variable used for in this SEH based buffer overflow payload?

I am trying to understand how a SEH based buffer overflow is working and I have to write a paper about how an exploit works. I took this PoC for my paper. junk = "\x41" * 4091 nseh = "\x61\x62" seh ...
1
vote
1answer
92 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
1
vote
4answers
204 views

What are the names of software vulnerabilities? [closed]

In web apps there are vulnerabilities like SQLi or XSS and many more. I heard that for hackers to hack a computer they have to find a vulnerability in a software that is running on an open port. ...
0
votes
0answers
64 views

Is SerializationException sign of Serialization/Deserialization vulnerability?

I am doing a bug bounty. I intercepted the POST request to the inscription in the target website. I modified the first name and last name POST params to inject bad char (in order to SQL inject) but ...
-1
votes
1answer
45 views

Bluetooth vulnerability on a Raspberry PI running Raspian

Is it possible for someone to exploit a Raspberry PI running Raspian through bluetooth just by having the bluetooth enabled?
2
votes
3answers
113 views

Need help on clarifying some pentesting concepts

Below are some conclusions I came up reading ebooks, blogs and tutorials about pentesting. I would like you to correct those conclusions if they are (all or partly) wrong. A vulnerability is any ...
62
votes
3answers
6k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
0
votes
0answers
47 views

Is document.write(window.location.hash.substr(1)) still exploitable for DOM XSS? [duplicate]

I stumbled upon Google's firing range for DOM XSS testing, and this case caught my eye: <script> var payload = window.location.hash.substr(1);document.write(payload); </script> As far ...
2
votes
4answers
167 views

Do video games on Windows have vulnerabilities?

You always hear about zero day vulnerabilities in Chrome, Skype, Zoom, Office, VLC, etc. But you never hear about vulnerabilities in video games (like popular multiplayer titles Fortnite or League of ...
1
vote
1answer
71 views

SQL vulnerable if input type = email check is enabled

<input type="email" class="form-control" name="email address" id="signinEmail" placeholder="Email address" aria-label="Email address" value="INPUT" required="" data-msg="Please enter a valid email ...
0
votes
2answers
72 views

Can demo exploits/attacks be run on desktop applications? [closed]

Are there any applications/tools for exploiting desktop applications? (with pre-built exploits) I'd like to test my Java desktop app for security. I've looked at tools like Metasploit, but they seem ...
0
votes
2answers
183 views

Installing xampp on virtual box?

I started learning PHP and I wanted to practice PHP code using xampp or wamp server. But after reading this and doing some google research,I thought that installing server software on my home pc ...
55
votes
7answers
12k views

Is this email asking me to sent them $100 for details on a security flaw in my website a scam?

I've just received this email. Is it a standard practice or a scam? I'm a Security Researcher running a vulnerability identification service for a small group of private clients, and I ...
1
vote
1answer
76 views

CVE-2020-5250 php vulnerability analysis

I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...
0
votes
0answers
91 views

Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?

My team and I have written a web app, and we had a bug report regarding a DoS vulnerability. This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
0
votes
1answer
100 views

Flash Vulnerabilities

What type of risks do I expose myself to by enabling flash in the browser? Web developers or online game developers who can use those vulnerabilities to crash my computer or exploit it by downloading ...
-3
votes
1answer
167 views

I found a security vulnerability in a web app developed by my university. Can it have a CVE number?

I found some serious vulnerabilities in my university's infrastructure. The infrastructure is a web app built with Spring and it's developed and used solely by the University. Using it I can get ...
0
votes
0answers
62 views

PadBuster Block Size check

After a small nikto scan I found a potential MS10-070 vulnerability on my server and while testing for the padding attack on the Padbuster tool, and after watching some exploits on youtube, I always ...
0
votes
0answers
113 views

Someone is Cryptomining from my Google Compute Engine Instance

I run an airflow instance which python process scheduler, which is used to trigger different python ML process which has no relation to crypto mining. This is the process which is running this ...
7
votes
2answers
2k views

Is it safe to send sensitive data in the post body to an azure function?

We want our users to send us a post request to an Azure Function endpoint. Is storing sensitive data (such as connectionstrings or passwords) in the post request body going to be an issue? Any insight ...
-1
votes
1answer
100 views

Is this domain vulnerable to XSS attack

I have a domain which when opened shows : Whatever I type after xyz.com/whatever appears on the title bar as xyz.com/whatever , if i write xyz.com/stackoverflow the title bar shows the same as xyz....
0
votes
1answer
83 views

How exploitable is a machine with a vulnerable library if it is not open to the internet? [closed]

Say I have a vulnerable library on a test machine, is it possible for an attacker to use that vulnerability to exploit the system and maybe the network, if the machine is not open to the internet?
2
votes
1answer
2k views

Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat

I have a question about Tomcat vulnerability CVE-2020-1938 aka Ghostcat. The security researcher who discovered the vulnerability created a write up here: https://www.chaitin.cn/en/ghostcat and a PoC ...
1
vote
1answer
98 views

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
0
votes
3answers
91 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
0
votes
1answer
69 views

How to prioritize npm dev vulnerabilities?

Running SNYK scanning on my code base I find a number of HIGH vulnerabilities when I include the npm dev dependencies (e.g. running SNYK -dev test --file=package.json). Examples of vulnerabilities: ...
0
votes
0answers
116 views

Hardware vulnerabilities vs software threats

What are the key differences between them? I find both of them would also be able to retrieve data from the host system and both also could cause harm. I do not understand why there are people who ...
2
votes
3answers
101 views

How to make sure vulnerability management does not lead to reduced or compromised security

When running vulnerability scans, often a particular version of, say, Node.js is reported to be vulnerable along with a recommendation to update to a higher version. Then we also have insecure SSL/...
5
votes
1answer
151 views

How dangerous are SWEET32 and LUCKY13 vulnerabilities?

I wonder how vulnerable are Sweet32 and Lucky13? I mean, how often do the attackers use these vulnerabilities to gain access?
0
votes
0answers
31 views

Risk, threat, vulnerability with an example

Given a situation where a system has SSL 3.0 and TLS 1.0 enabled would the following mapping be accurate: Weakness/vulnerability: The remote service accepts connections encrypted using TLS 1.0 and ...
3
votes
1answer
107 views

What is the risk of having an old, Internet capable phone not used for Interned compromised? (not smartphone)

I'm talking about a class of old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the ...
1
vote
0answers
91 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
1
vote
0answers
204 views

Disable vulnerable cipher suites

As a part of my learning, I installed OpenVAS into one of our Ubuntu test servers and scan the said server. I have the results and I wanted to remediate the findings as part of my learning the Linux ...
0
votes
1answer
105 views

Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL?

If a website uses an auto-incrementing user-id in its url – /users/1, /users/2 to showcase public user profiles (just the name + photo / avatar) is it considered a possible vulnerability?
14
votes
2answers
3k views

Is a crash always exploitable for RCE?

Reading papers written by teams looking for vulnerabilities using fuzzing, I notice that many people label a crash as a DoS vulnerability. While in other papers and researches, they go deeper after ...
0
votes
1answer
62 views

Is NSA disclosure of CRYPT32 vulnerability a charitable public service? [closed]

News coverage of this makes it sound like the NSA is mending fences and helping us all out, kindly and heroically. I have nothing against the NSA but isn't it more likely an adversary has been ...
38
votes
7answers
13k views

Is it a security vulnerability to tell a user what input characters are valid/invalid?

For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field? CWE-200: Information Exposure says one ...
1
vote
1answer
172 views

vulnerability management, risk mitigation vs risk acceptance

I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be ...

1
2 3 4 5
17