Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
1answer
99 views

Sacrificing 30% of my CPU performance (by disabling Hyper-Threading) to fully mitigate CPU vulnerabilities, necessary?

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
1
vote
1answer
100 views

Is the “2038 bug” considered as a vulnerability? is it possible to exploit this?

Is it possible to use the "2038 bug" on all kinds of systems / sites that use a calendar and similar features, in order to exploit a certain system in some way?
0
votes
1answer
35 views

can you have reflective xss through a POST parameter?

While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload)...
-1
votes
2answers
220 views

How do I sell critical vulnerability info to private company? [on hold]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
2
votes
2answers
173 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
1
vote
1answer
71 views

HTTP header injected in meta tag

When I add the HTTP header X-Forwarded-Host: bing.com, a meta tag is injected into the site: <meta property="og:url" content="https://bing.com/argentina"/> Does this have any security impact? ...
0
votes
1answer
49 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log?
0
votes
0answers
45 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
1
vote
0answers
41 views

Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing

Someone requested my site's (Wordpress/Apache) 'includes' directory: 122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" Noticing the 200 response, I hit ...
1
vote
0answers
40 views

Access default to true vulnerability

I remember there is a TOCTOU-related vulnerability, where one should never default the access of a user to true and set to false if something goes wrong, but default it to false and set it to true ...
0
votes
1answer
92 views

What type of vulnerabilty is this?

I'm testing a website: https://this-site.com/path/to/dirs but what i've found is if I do the following below the site will load 4 pages in a infinite loop https://this-site.com/path/to/dirs/.../. ...
4
votes
1answer
95 views

Is it possible to change an API response using the host file?

Would it be possible for someone to hijack the response of an API by using the host file, so for example www.sitename.com calls api.sitename.com/api/products. Could I use the host file to redirect the ...
2
votes
1answer
83 views

Best Security measures for non-IT pro to take when at risk of hackers? [closed]

I work at a WeWork and am surrounded by about 5 different IT / coding type of companies. They apparently hacked me somehow, I don't know how, whether it was bluetooth or using WeWork wifi, or maybe ...
0
votes
0answers
46 views

Do all Javacards have S@T Toolkit installed already

Do all Java SIMs (Java card based) contain S@T/ SIMAlliance Toolkit, making them vulnerable to SIMjacker attack?
1
vote
1answer
87 views

Is it possible to exploit computer vision to achieve remote code execution?

What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution? The only ...
9
votes
1answer
1k views

simjacker: which SIMs are vulnerable?

simjacker.com looks like a pretty serious security issue with SIM cards. There's not much technical detail on their website though. And it'd be nice to be able to already know which SIMs are ...
4
votes
1answer
68 views

What's the security risk of using a protocol-relative URL in a CSS stylesheet?

I used SonarQube to perform a static code analysis of my project and it detected a security vulnerability in one of my CSS files: For security reasons, protocol-relative URLs should not be used. ...
0
votes
1answer
64 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
2
votes
1answer
60 views

2FA/MFA and Session management

Background Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary ...
0
votes
1answer
49 views

response when sent emailed links to personal information

I'm filling out tax information. The accountants out-source the survey collecting the tax info to another company. Seems fair enough - I'd rather have computer experts handle the technical ...
5
votes
1answer
97 views

Misconfiguration security vulnerability disclosure [duplicate]

I accidently discovered a misconfiguration (?) security vulnerability: Workstation managing system is publicly exposed with default credentials. admin/admin The system contains arround 2k ...
20
votes
5answers
4k views

Can a network vulnerability be exploited locally?

I've been looking for information about vulnerability classification and it's not completely clear to me. Reading the CVSS documentation (2.1.1. Access Vector) I observe the following explanation ...
1
vote
0answers
59 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
2
votes
3answers
97 views

Is prototype pollution only exploitable on the back end?

I received a Jira as a result of a security scan asking to update lodash for CVE-2019-10744, which is a prototype pollution vulnerability. After reading this excellent paper about prototype pollution, ...
3
votes
0answers
50 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
0
votes
0answers
43 views

Windows RDS vulnerability

Further to windows thuesday patches and the 4 criticals vulnerabilities related to RDS, i want to know if i'm exposed to the risk or not. I don't have port 3389 exposed to internet, and i read in in ...
1
vote
2answers
90 views

Exploitation tactics for heap over-reading?

One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction: Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
2
votes
2answers
83 views

XSS Mitigation using regex

I am allowing following character in regex that is dash, tilde, attherate, a-z, A-z, 0-9 [A-za-z_0-9.,\t\r()\\[\\]@ ~/[-]+$] Is there any possibility to bypass these regex? Actually, whenever ...
1
vote
1answer
102 views

How can I detect CVE-2018-0886 vulnerable hosts in my network?

I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more. Most ...
1
vote
1answer
184 views

Path Manipulation Vulnerability

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension public class ReadFile { ...
0
votes
1answer
55 views

Security test within a staging environment. Is SOAPUI sufficient as a test tool?

Currently I am working on a project in which I am supposed to define the following aspects as a test manager: Conception of a penetration test for a test staging environment Planning security ...
-2
votes
1answer
83 views

Is IDOR (Insecure Direct Object Reference) a server-side or client-side vulnerability? [closed]

I want to know if IDOR is a client-side or server-side vulnerability. In my opinion, it is a server-side vulnerability.
0
votes
2answers
607 views

Possible attack via Netflix; what action should I take, if any?

Late last night I received a "password reset" email from info@mailer.netflix.com. It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw ...
2
votes
1answer
557 views

Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?

I am learning about file upload vulnerabilities using DVWA. After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in ...
2
votes
1answer
99 views

Can you exploit an application that imports a vulnerable library, but does not actually use the classes from the library?

Suppose you have vulnerable library, vuln-lib.jar, that you then import into your source code but never actually use: #My imports import com.vuln.lib.* #My code .. And you go onto to deploy this ...
-1
votes
1answer
99 views

Which database is used by npm-audit

you probably know the npm-audit tool which informs you about vulns in your node.js projects dependencies. I'd like to know what database npm-audit is using and how I get access to this data. Thank ...
1
vote
1answer
60 views

Does encapsulation of encryption within a library provide some kind of additional security?

Lets say there is an industrial device communicating with a central system. Secure communication is required from an end to end point of view. From time to time keys of the devices must be renewed by ...
1
vote
2answers
138 views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
2
votes
2answers
107 views

How do I get the “vulnerabilities history” of a Node.js package?

When installing a Node.js package via npm or when running npm-audit I get information about known vulnerabilities of packages in the project. From my understanding this means that there must be some ...
7
votes
1answer
974 views

TCP Sack panic proof of concept?

For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies? [1] ...
1
vote
2answers
168 views

If a vulnerability has no relevant attack vectors, is monitoring still legitimate for a company?

Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in ...
2
votes
3answers
168 views

Do I need to worry about vulnerabilities that require administrative privileges to exploit?

I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines. What confuses me is that fact that those vulerabilities are scored with a high risk score, but require(...
2
votes
0answers
110 views

What are the security implications of RAMBleed?

The RAMBleed vulnerability uses Rowhammer induced bitflips to derive contents of memory that it should not have access to. This works with ECC RAM too. It is definitely scary. Is this vulnerability ...
22
votes
1answer
4k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
1
vote
0answers
38 views

Report security vulnerability [duplicate]

I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs. Brief information on target: The website is built to ...
1
vote
1answer
345 views

Is disabling Remote Desktop Services sufficient to protect a Windows device from the BlueKeep vulnerability?

Microsoft (and the NSA) have been urging Windows users and administrators to install patches to protect systems from the BlueKeep (CVE-2019-0708) vulnerability. Is disabling Remote Desktop Services ...
46
votes
5answers
7k views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Imagine the following code: ATTACKERDATA="$(cat attackerControlledFile.txt)" echo "${ATTACKERDATA}" An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
0
votes
1answer
114 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
1
vote
1answer
66 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
0
votes
0answers
108 views

Generating a valid payload for RichFaces 3.X

I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload ...