Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
45 views

Under which situations is open redirection possible?

I am searching about the open redirection attack. When I look at websites that try to explain the situation, they generally say to test the URLs in the form of www.example.com?redirection=... to see ...
Not a Salmon Fish's user avatar
0 votes
1 answer
55 views

Is an isolated VM (Hyper-V) still safe despite the fact that the host uses RDP to view/control the VM?

This question is directed towards creating an isolated environment for a reverse engineering VM, where malicious programs will be disassembled, debugged by executing them, so static and dynamic ...
stringExchange's user avatar
1 vote
0 answers
50 views

Is it possible to exploit this supposedly boolean-based blind and time-based blind SQLi (sqlmap)?

I recently found a boolean-based blind SQLi and since I'm new to the bug bounty scene - I don't understand what impact I can extract from it. There is a website like example.com/tarif?tableId=136&...
Andrey's user avatar
  • 11
-2 votes
0 answers
27 views

How consistent are CVSSv4 scores? [closed]

The University of Erlangen-Nuremberg (Germany) is conducting a research study to investigate the consistency of CVSSv4 (Common Vulnerability Scoring System). If you are currently assessing ...
fau-cs1-study's user avatar
0 votes
1 answer
59 views

Are all stateless authentication systems vulnerable to IDOR?

I have recently been introduced to the Insecure Direct Object Reference vulnerability (https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html) with ...
Rands's user avatar
  • 1
0 votes
0 answers
65 views

How can I safely write in my resume that I have written a MetaSploit exploit module without making employers nervous?

I have asked this question on The WorkPlace SE site and did not receive any comprehensive answers over there. I have around 10 years of cybersecurity industry experience and have gained proficiency ...
Anthony's user avatar
  • 1,756
0 votes
1 answer
98 views

why is an allocated buffer stored on the stack and the heap?

I have this code which has a format string vulnerability in it: #include <stdio.h> int main() { char buf[1024]; char secret1[64]; char flag[64]; char secret2[64]; // Read in first ...
Moshe D's user avatar
  • 103
0 votes
2 answers
56 views

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
0xdead 4f's user avatar
0 votes
0 answers
68 views

how to exploit CVE-2023-1613

I am trying to understand the vulnerability in Rebuild in chromium which is identified as CVE-2023-1613. I found this poc online: https://github.com/getrebuild/rebuild/issues/596 What I understood so ...
anonymous's user avatar
2 votes
1 answer
272 views

How to report related findings in a pentest report

I am running a pentest on a web application, and I detected a vulnerability but I am not sure how to report it. I am confused if I should split it or document it as 1 finding. I will explain below. So ...
anonymous's user avatar
0 votes
0 answers
69 views

Bash deletes null bytes in exploit input for ROP/returntolibc

I am trying to do a returntolibc exploit. The goal is to gain a shell with root privilege by calling setuid(0) and then system("/bin/sh"). I have been agonizing over trying to get this thing ...
germphjd's user avatar
0 votes
1 answer
169 views

If a library has a vulnerable function, but my code doesn't call it, is my code at risk? Do I need to update?

I am trying to analyze CVE-2023-34453. As per the NVD description, there is an integer overflow error in snappy-java, specifically in the method shuffle(int[] input) in BitShuffle.java. In a huge ...
anonymous's user avatar
0 votes
1 answer
177 views

CVSS attack vector adjacent vs network

I am trying to calculate a CVSS score for a vulnerability. In my case, to exploit the vulnerability you should have network access to the server, which is sitting behind a firewall. This server is ...
anonymous's user avatar
2 votes
2 answers
138 views

Attack surface when no incoming port is open [closed]

Let's assume that the only attack to be feared on a computer is one via the network in which the machine is embedded. What options does an attacker have if the machine has no open incoming ports? (For ...
fkarger's user avatar
  • 21
2 votes
2 answers
146 views

IDOR or something else?

While analyzing a web application, I identified a path of the type https://example/remove/123, which allows a user with lower privileges to remove a report created by a user with higher privileges. In ...
hagick's user avatar
  • 23
0 votes
1 answer
266 views

SSRF trough Gopher

Gopher protocol is used a lot when exploiting SSRF, but how? a Gopher URL takes the form: gopher://<host>:<port>/<gopher-path> but let's take this example: gopher://10.10.10.3:80/...
jeff's user avatar
  • 3
0 votes
0 answers
143 views

How safe is it to run an un unpatched, internet-exposed OpenSSH service?

There have recently been several reported security issues with OpenSSH (Terrapin, double-frees, remote execution, X11 forwarding vulnerabilities..). How safe is it for a server to expose OpenSSH (...
benjimin's user avatar
  • 175
0 votes
2 answers
289 views

What are Cookies SQL injection?

After applying web vulnerability scan on a site that I have, I found a vulnerability called Cookie SQL injection, and applied on the requested cookie. What is this vulnerability? and how can I solve ...
user avatar
2 votes
2 answers
1k views

are new CPUs still vulnerable to attacks like Spectre and Meltdown?

Are the most modern CPUs still susceptible to attacks like Spectre and Meltdown? Is it worth enabling the fixes in kernel (which hit performance) ? Lets say high end laptop CPU such as the AMD Ryzen 7 ...
Martin Vegter's user avatar
1 vote
0 answers
86 views

i am exploiting CVE-2015-8249 metaploitable 3 , but reaching https:/targetip:8383 its says 503 error why? [closed]

I am exploiting CVE-2015-8249 on metaploitable 3, but reaching https:/targetip:8383 it says 503 error why? These are the sources I am following to exploit: https://www.hackingtutorials.org/metasploit-...
 Warda Tariq's user avatar
1 vote
0 answers
98 views

Can an embedded 3rd party JS script access or keystroke log an iFrame's content

Say there is a web page with two 3rd party javascript URL scripts embedded in it. One creates a support chat window and the other creates an iFrame within which a user enters payment information into ...
AndyW's user avatar
  • 111
1 vote
0 answers
109 views

out-of-band data exfiltration Command Injection [closed]

A few days ago I found a vulnerability in a site of scope using the Burp suite scanner with the command nslookup xxx.burpcolaborator.com exploit with the following feature: Issue: OS command injection ...
Deviandorx's user avatar
1 vote
0 answers
84 views

Blind SQL Injection on a HP printer?

The vulnerability test from Nexpose scanned the HP printers and last scan shows "Blind SQL Injection / Remedation plan: Ensure that the Web application validates and encodes user input before ...
Karo1337's user avatar
1 vote
0 answers
67 views

Information on the Exploitation and Automatability Data for Vulnerable components

Is there any tool providing information such as exploitability state (i.e., None, POC & Functional/Active) and automatability data for a specified vulnerable component name and version?
sad_semicolon's user avatar
4 votes
1 answer
3k views

Note Taking App Hacked?

I am using the note taking app Color Note (www.colornote.com) on my mobile phone that is using Android 7.1.1 to take some notes (old device). I am not using their cloud sync capability, and my email/...
J_A's user avatar
  • 57
1 vote
0 answers
113 views

Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?

I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
LunaXenon's user avatar
24 votes
3 answers
6k views

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
Dantre's user avatar
  • 343
0 votes
2 answers
240 views

Kernel level attack?

In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the ...
Student's user avatar
  • 101
0 votes
2 answers
181 views

Mitigating vulnerabilities in audio libraries that cause physical damage

As I pointed out here in February 2022, people who gained brief direct or remote access to a machine can change the volume step or other things regarding sudden large changes to the sound volume (for ...
mYnDstrEAm's user avatar
1 vote
4 answers
384 views

GPS metadata in uploaded pictures: vulnerability or not?

If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? Why? And would it be ...
reed's user avatar
  • 15.8k
0 votes
0 answers
297 views

How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?

I'm a beginner bug bounty hunter, and I recently came across a Self-XSS vulnerability during my security testing on a target website. The vulnerability occurs when I inject a payload into the X-...
Giancarlo Eduardo's user avatar
0 votes
0 answers
159 views

HSM Thales PayShield vulnerabilities

My management requested to investigate about security of HSM Thales Payshield. Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
MaXbeMan's user avatar
0 votes
0 answers
82 views

How to reproduce this CVE-2020-7774 parameter pollution vulnerability

While pentesting a website I came across yarn.lock file that contains an application dependency and I found this vulnerable library y18n v4.0.0 to CVE-2020-7774. How can I reproduce the vulnerability ...
ben39's user avatar
  • 1
0 votes
0 answers
30 views

Bank employees asked random 2 characters of password during verification! [duplicate]

Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line? They said me that it is verification procedure but I am not sure it ...
Oleksandr Ismailov's user avatar
0 votes
0 answers
108 views

Is there any increase to known security risks by mounting the EFI System Partition, on a Windows 10 PC?

Security risks, as in malware, attackers, or known vulnerabilities. Threats while the ESP is mounted, or after unmounting. E.g. Could it open access routes for future attackers. I aim to avoid ...
Eric's user avatar
  • 1
0 votes
1 answer
169 views

What to do if a bank doesn't admit it leaked millions of customer's data [closed]

I found a breach on a bank's website a few months ago which exposed customer data including: SSNs, account numbers, account balances, physical addresses, payment history, tax forms, temporary login ...
my-name's user avatar
2 votes
0 answers
123 views

Why are certain hashes missing from the .git objects folder?

I'm currently attempting to pentest a web application created by a relation, who wanted me to find vulnerabilities and to let him know what exploits would be possible with said vulnerabilities. I have ...
Loebstahhhh's user avatar
0 votes
1 answer
118 views

Does the presence of an "unsafe" function in an object file pose a security risk

I've read that there are unsafe functions that we should try to avoid when writing C/C++ programs for example the gets() or strlen() functions. Let's say I compile a .cpp/.c file into an object file ...
KetDog's user avatar
  • 101
1 vote
1 answer
312 views

Bypassing root detection qualify as a vulnerability?

I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways. My main question is: ...
Exnovan's user avatar
  • 35
0 votes
1 answer
102 views

How can I get CISA weekly summary sorted by vendor rather than by CVE? [closed]

I subscribe to the CISA's weekly vulnerability summary email. This USED to come sorted by vendor/product, so I could quickly skip over the Cisco and Wordpress vulnerabilities to check the stuff I care ...
Old Bald Guy's user avatar
0 votes
1 answer
191 views

Is the vulnerability reporting to our website actually a scam? [closed]

An individual contacted us claiming that he discovered vulnerabilities in our website. He also showed his intention to show us detailed information about the vulnerabilities, including how to ...
sanba06c's user avatar
  • 123
0 votes
0 answers
120 views

Possible authentication vulnerability, is it an issue?

I have found an interesting bug (?), but I'm not sure if it is an actual vulnerability. Let's assume we have target, A, user, B, and 3rd party auth provider, C. User B signs up with target A with ...
UCYT5040's user avatar
  • 101
1 vote
1 answer
446 views

CVSS3 Scope change question

Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
mateleco's user avatar
  • 110
1 vote
2 answers
472 views

Coverity flags as unsafe deserialisaton. Is this vulnerable?

Coverity shows the block of code as unsafe deserialization: String str = OBJECT_MAPPER.writeValueAsString(body); //Body is user controlled Ferarri myclassobj = OBJECT_MAPPER.readValue(str, Ferarri....
warrior-oo7's user avatar
2 votes
0 answers
155 views

Is a mobile phone number in itself an information that can be utilized by hackers etc? [duplicate]

I recently installed Tinder, and I saw that the app warns about sharing your phone number to avoid being hacked. I also noticed certain obviously fake profiles pressing for getting a phone number or ...
smith's user avatar
  • 121
0 votes
1 answer
560 views

CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API

I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
Tlopasha's user avatar
2 votes
1 answer
385 views

Is running rsync as root problematic?

Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du? Background: I'm moving data from various systems ...
Fizz Khalifa's user avatar
0 votes
1 answer
211 views

Filter CVEs by affected OS

Is it possible to filter CVEs by affected platform/OS? Some sources do provide this, like exploit-db, but the main vulnerability source NVD, National Vulnerability Database, doesn't seem to have such ...
e-epsojn's user avatar
1 vote
0 answers
287 views

Am I exploitable to CVE-2023-20862?

I am trying to analyze whether I am exploitable to the new CVE in spring security. As per Spring they mention the following: Specifically, an application is vulnerable when any of the following is ...
ethicalhacker's user avatar
20 votes
4 answers
5k views

Is a responsible disclosure for hardware-based vulnerabilities even possible?

In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might ...
dudekowsky's user avatar

1
2 3 4 5
21