Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

1
vote
0answers
8 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
1
vote
1answer
50 views

Is there a standard for labeling a vulnerability as intentional?

US concerns of intentional vulnerabilities placed in foreign manufactured equipment has lit up headlines. Is there a standard that sorts (differntiates) poor-designs from intentionally placed ...
-1
votes
0answers
11 views

faraday ide doesn't import the openvas scan [on hold]

I'm trying to add an xml result file from openvas in faraday but when i import it, nothing happens. Could someone help me please? My file is located in the downloads folder and when I load the file, ...
1
vote
2answers
33 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
74 views

Internal HTTP(s) vulnerabilities

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
-1
votes
0answers
9 views

Update the glibc package Error [migrated]

I was asked to fix the vulnerabilities for RHEL 7: GLIBC(RHSA-2018:3092). Based on the output given by Nessus. Remote package installed : glibc-2.17-222.el7 Should be : glibc-2.17-260....
1
vote
0answers
37 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
0
votes
1answer
38 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
0
votes
0answers
63 views

Disclosing a vulnerability when ignored by vendor [duplicate]

I have discovered a vulnerability in a fairly popular Java library. The vendor has an official way to report security issues but the library maintainer said that it's not a vulnerability, even though ...
2
votes
3answers
328 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
-1
votes
0answers
16 views

Unquoted Service Path Related Questions

I read a about "Unquoted Service Path" technology. Without "everyone" authority, I think it's impossible. It is not possible to plant a EXE file in the path. Because need UAC privilege. Why is ...
2
votes
1answer
96 views

How long to wait before publishing a web vulnerability?

I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several ...
2
votes
1answer
34 views

envelope encryption (using KMS) vs ECDH

at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the ...
0
votes
2answers
114 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
13
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
2
votes
0answers
68 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
2
votes
1answer
53 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
0
votes
2answers
76 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
0
votes
1answer
129 views

Reverse Shell Exploit for SquirrelMail 1.4.22 [closed]

I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is ...
0
votes
1answer
97 views

What famous attacks used a use-after-free vulnerability?

I'm compiling vulnerabilities and related attacks, and I need to find a famous attack that exploited a use-after-free vulnerability. I've looked for a while though I can't seem to find any. I know ...
1
vote
1answer
83 views

Default or Guessable SNMP community names: public

We have detected "Default or Guessable SNMP community names: public" vulnerability in one of our printer through Nexpose. The remediation states we have to secure SNMP installation. What does it mean ...
0
votes
1answer
87 views

Could an Smart TV be a threat for a hotel?

After some research I found that a Smart TV which is connected on the Internet could be vulnerable to threats such as monitoring, taking control of the tv etc. I wonder if a Smart TV which is used by ...
0
votes
1answer
60 views

How to search for all computers running memcached on shodan

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port ...
1
vote
2answers
45 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
2answers
135 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
2
votes
1answer
883 views

How did a bug like CVE-2018-10933 (libssh authentication bypass) happen?

How did a bug like the recent libssh vulnerability come to exist? Exactly what is the nature and root cause of the bug? From libssh's website: libssh versions 0.6 and above have an authentication ...
70
votes
3answers
27k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
2
votes
1answer
116 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
0
votes
1answer
29 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
1answer
209 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
0
votes
0answers
55 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
2
votes
3answers
120 views

Do WordPress vulnerabilities matter in intranet?

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only ...
0
votes
1answer
59 views

How secure is a serial/terminal/console server, from the serial side?

I'm upgrading my home lab, and one of the things I'm planning on introducing this time is out-of-band management through a Raspberry Pi console server similar to this: https://www.packet6.com/...
1
vote
2answers
46 views

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and ...
5
votes
1answer
204 views

Can hand/finger movements be determined via changes in WiFi signal strength?

On a password generator website I came across the following claim among a list of security tips: If there are WIFI routers in your home, then it's possible to know the passwords you typed (in your ...
0
votes
0answers
82 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
0
votes
0answers
44 views

Execute Injected Shellcode

The environment is Windows XP SP3 32 bit and the programs was compiled with Visual C++ 2008 Express Edition without DEP, ASLR, SafeSEH and SEHOP. I tried to exploit the SEH. I see in WinDBG that the ...
2
votes
1answer
99 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
2
votes
1answer
485 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
1answer
91 views

Recent attacks and vulnerabilities [closed]

How can I be up to date and get news on recent attacks and vulnerabilities? Is there any trusted source of information (websites, databases, ...)
2
votes
1answer
56 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
1answer
177 views

Do vendors put backdoors on network devices?

There are several articles that says that vendors plant backdoors on network devices intentionally, such as this one. They found backdoors that were made by the vendors. Also, I read somewhere else ...
61
votes
2answers
11k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
0
votes
3answers
171 views

Is It More Secure to Use Firewalls from Two Different Vendors?

The topic is "Is It More Secure to Use Firewalls from Two Different Vendors " Is not much safer using a multi-vendor firewall because "More than 95% of firewall breaches are caused by firewall ...
1
vote
1answer
169 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
1answer
81 views

Is it possible to get data from database server if you are on the application server?

For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
3
votes
2answers
189 views

How do hackers find vulnerabilities in closed source operating systems?

I'm not planning on hacking anything, but I'm just wondering how hackers find vulnerabilities in closed source operating systems such as Windows, since they don't know exactly what the code is doing? ...
1
vote
1answer
149 views

What are good, safe, not necessarily anonymous ways to disclose vulnerabilities?

Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be ...
0
votes
0answers
32 views

Apache 2.4.10 child process hang

We're running a auto-scaling instance group in Google Cloud Compute Engine (Debian 8, Apache 2.4.10) and discover that Apache's child processes are not closing properly (apparently they keep open ...
0
votes
0answers
99 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...