Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Validating data sent by a client [migrated]

I am doing security testing for my java web application which is built on Struts. The very first vulnerability I found by burp suite is that I am able to change request parameter values. How can we ...
2
votes
2answers
107 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
-1
votes
0answers
27 views

routersploit like scanner for networks nearby [closed]

I study routersploit and all I see is that you should set target and give an IP for scanning. This is great if you're in the same network with the router or you know the public ip of the router you ...
0
votes
2answers
92 views

Can vulnerabilities in libraries cause security problems in user-level binaries?

https://trailofbits.github.io/ctf/vulnerabilities/source.html It says "Common examples include libraries like libxml, libpng, libpoppler, and libfreetype that parse complicated file formats and ...
0
votes
0answers
29 views

What is the nature of vulnerabilities in JS modules used client-side?

When installing JavaScript modules, I sometimes see that some of them have security vulnerabilities. It made me wonder about the kind of vulnerabilities this could be, and how they could be exploited ...
5
votes
2answers
745 views

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?

I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE. We noticed that some application (let's call it vendor B), contained the library of vendor A, we ...
3
votes
0answers
69 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
1
vote
0answers
32 views

Crowdstrike Sensors - Do they need inbound, as well as outbound access? [closed]

As per the title, I'm looking for insight on the crowdstrike sensor. Does anyone know if, on top of the outbound pt:443 access to the domains it requires, whether it also requires inbound connectivity?...
2
votes
1answer
127 views

vulnerability management 101

Looking at a typical vulnerability scan report from Nessus or Qualys most people are terrified, lost, and basically with more questions than answers. For example, how on earth am I going to deal with ...
2
votes
1answer
47 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
57 views

Is rsyncd secure? (except for the lack of transport encryption)

I have been using an rsyncd server for backups for what feels like a decade. I saw that rsyncd has no transport encryption (not even for username and password). I wonder what other security issues ...
0
votes
2answers
122 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
1
vote
1answer
66 views

CGI-BIN - suspicious activity (unknown IP made request)

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...
0
votes
1answer
46 views

How to handle as a Tester if the website is kicking out the user for recreating the session?

Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! ...
4
votes
1answer
754 views

Does “emergency mode” help protect iOS devices in AFU mode?

In recent iOS devices you can temporarily disable unlocking via biometrics by holding the power button and either volume button for a couple seconds. I’m trying to find out if this does anything to ...
0
votes
0answers
33 views

Is there an analysis/whitepaper out there regarding RCE with ICMP Echos against windows hosts?

I know this might sound silly but given what happened with SIGRed I wanted to ask and see what those who know think: Is there an audit or analysis out there showing the possibility of RCE with ICMP ...
3
votes
3answers
1k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
1
vote
0answers
43 views

Is it ok to give the client the power to make any request from within our server?

We have a very heavy endpoint on our server, that takes a few hours to respond. Of course, this would result in a timeout, so we added an "asynchronous" functionality to it. To summarize, a ...
1
vote
1answer
107 views

What are criteria and rules to determine bug bounty amounts? [closed]

How is the reward amount determined on different bug bounty platforms like Bugcrowd, HackerOne or Synack? As a bug bounty program owner I can maybe define some rules for the rewards. What are the ...
2
votes
0answers
42 views

Zip Slip path traversal and consistent vulnerability checks

According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory: String ...
1
vote
1answer
71 views

Vulnerabilities for multiple kernel versions that are installed on a given server

As per Exclude or display vulnerabilities for non-running Linux kernels : It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on ...
0
votes
0answers
64 views

How long does a HiddenEye keylogger script last in an Android browser?

I recently clicked on a phishing link and entered my credentials but then I changed the password. I believe the phisher used HiddenEye with a keylogger script in the webpage so how long can he capture ...
0
votes
2answers
77 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
2
votes
1answer
99 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
-2
votes
1answer
170 views

Nexpose Vulnerability scanner

Is it normal to get 3000+ vulnerabilities while scanning server using Nexpose? Or I can reduce the vulnerability to decent count by some tweaks!
4
votes
0answers
104 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
4
votes
2answers
218 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
0
votes
0answers
50 views

Is malware in an EC firmware a concern, when standard security is in place together with the rest of the computer having no malevolent tampering?

Question My question is whether malware in the embedded-controller firmware is something to worry about if the rest of the computer system is faithfully what it should be, together with standard ...
0
votes
1answer
41 views

can vulnerabilities be treated differently based on ceratin circumstances? [duplicate]

We are running vulnerability scans on our systems. I can see a few XSS vulnerabilities being reported, such as CVE-2020-14173. Let me quote: The file upload feature in Atlassian Jira Server and Data ...
1
vote
0answers
48 views

Remote file inclusion (RFI) found - vulnerability or false positive?

For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
90
votes
6answers
14k views

Why does my IT department block Firefox?

We received a message from the IT bods this week stating: Summary of the issue: IT will disabling and blocking the use of the browser Firefox next Thursday the 03.12.20 on all IT managed devices. Due ...
3
votes
1answer
452 views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
3
votes
2answers
100 views

How to estimate threat and risk associated with that threat and not only vulnerability severity?

Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part. I ...
3
votes
0answers
84 views

Can/should I automatically report network break-in attempts?

For the last 15 years I've been using SpamCop to report the spam I receive. I do this because it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
0
votes
1answer
53 views

Using outdated ADSL modem with up to date router - Security Concerns

My parents live way out in the middle of nowhere. The only service provider that is not satellite is Century Link, which uses ADSL / phone lines. They wanted me to set them up, and the service guy was ...
1
vote
1answer
81 views

Is it possible for a self-extracting file to run malware on Linux?

I know that you need to change permissions for a file to run as a script on Linux. Is that enough to prevent any malware from being installed by some self-extracting file? Is there anything that can ...
0
votes
1answer
281 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
1
vote
1answer
294 views

Can string concatenation in file_get_contents() be exploited in PHP?

Let's say I have the following PHP code: <?php echo file_get_contents($_GET['path'] . ".txt"); Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
0
votes
1answer
78 views

Is it possible for someone to make a purposefully vulnerable site then take advantage of that vulnerability to hack the users?

Is it possible for someone to make a purposefully vulnerable site then lure users to his site where he then takes advantage of that vulnerability to hack their social media accounts etc? If so how?
0
votes
0answers
55 views

Can python be used to retrieve a session ID to mimic logged in user at periodical times?

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
0
votes
4answers
112 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
0
votes
1answer
215 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
1
vote
1answer
151 views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
1
vote
0answers
54 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
2
votes
1answer
161 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
2answers
114 views

Possible SSRF in image tag that takes (partial) user input?

A webapp has an img tag that partially takes userinput like so: <img src="/blah/blah/$USERINPUT.jpg"> where the first / is from the root of the domain. Could there be a vulnerability ...
1
vote
1answer
87 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
1answer
111 views

How can I tell if a program (in this case Jitsi Meet Electron) has bad-enough vulnerablities making it unsafe for current use and/or protect myself? [closed]

I'm uneasy that Jitsi Meet (videoconferencing stack) is Chrome-first (bug relating to other browsers are fixed later) and dislike Chrome for privacy reasons. Jitsi has an Electron desktop web-wrapper ...
-1
votes
1answer
57 views

Is there any document that contains all web vulnerabilities of OWASP? [closed]

OWASP top 10 lists the top 10 web security risks. But I didn't find the other vulnerabilities out of the top 10 in OWASP site. Is there any document that contains all web vulnerabilities?
0
votes
1answer
66 views

Is there any authoritative classification of vulnerabilities?

Is there any classification of vulnerabilities ? As we know, there are many vulnerabilities, such as: SQL injection vulnerability, File upload vulnerability, File contains vulnerability, XSS, SSRF, ...

1
2 3 4 5
18