Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

2
votes
1answer
55 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
0
votes
1answer
19 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
-1
votes
0answers
70 views

Protecting licensed software when deployed on premises with the licensee

Being a beginner in security and as part of one of my projects, I would like to determine what are the ways software might be vulnerable when deployed in in a specific scenario. Let's say that ...
1
vote
1answer
141 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
0
votes
0answers
20 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
2
votes
3answers
110 views

Do WordPress vulnerabilities matter in intranet?

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only ...
0
votes
1answer
52 views

How secure is a serial/terminal/console server, from the serial side?

I'm upgrading my home lab, and one of the things I'm planning on introducing this time is out-of-band management through a Raspberry Pi console server similar to this: https://www.packet6.com/...
1
vote
2answers
43 views

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and ...
-1
votes
0answers
23 views

When do I know there is a zone transfer vulnerability? [duplicate]

I am using python for doing this all stuff. Here is the code: import dns.resolver import dns.query import dns.zone ns = [] def exce(domain): answers = dns.resolver.query(domain,'NS') ...
5
votes
1answer
194 views

Can hand/finger movements be determined via changes in WiFi signal strength?

On a password generator website I came across the following claim among a list of security tips: If there are WIFI routers in your home, then it's possible to know the passwords you typed (in your ...
0
votes
0answers
36 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
0
votes
0answers
30 views

Execute Injected Shellcode

The environment is Windows XP SP3 32 bit and the programs was compiled with Visual C++ 2008 Express Edition without DEP, ASLR, SafeSEH and SEHOP. I tried to exploit the SEH. I see in WinDBG that the ...
2
votes
1answer
61 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
2
votes
1answer
215 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
1answer
88 views

Recent attacks and vulnerabilities [closed]

How can I be up to date and get news on recent attacks and vulnerabilities? Is there any trusted source of information (websites, databases, ...)
2
votes
1answer
48 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
1answer
150 views

Do vendors put backdoors on network devices?

There are several articles that says that vendors plant backdoors on network devices intentionally, such as this one. They found backdoors that were made by the vendors. Also, I read somewhere else ...
61
votes
2answers
11k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
0
votes
3answers
111 views

Is It More Secure to Use Firewalls from Two Different Vendors?

The topic is "Is It More Secure to Use Firewalls from Two Different Vendors " Is not much safer using a multi-vendor firewall because "More than 95% of firewall breaches are caused by firewall ...
1
vote
1answer
162 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
0answers
24 views

?, / or ; in input query string are causing errors. What does that mean?

I am currently testing a website and realized that if I put ; and/or % into the input for a search query it causes a 505 Internal Error. Putting a ? in causes a 404 Page not found. The URL for the ...
0
votes
1answer
78 views

Is it possible to get data from database server if you are on the application server?

For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
0
votes
0answers
27 views

User input directly put into pptx

I'm testing a web application where user input is directly put into the slides of a .pptx template. I know of vulnerabilities in .csv, .xls, .xlsx, where this could lead to data extraction or code ...
2
votes
2answers
165 views

How do hackers find vulnerabilities in closed source operating systems?

I'm not planning on hacking anything, but I'm just wondering how hackers find vulnerabilities in closed source operating systems such as Windows, since they don't know exactly what the code is doing? ...
1
vote
1answer
116 views

What are good, safe, not necessarily anonymous ways to disclose vulnerabilities?

Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be ...
0
votes
0answers
27 views

Apache 2.4.10 child process hang

We're running a auto-scaling instance group in Google Cloud Compute Engine (Debian 8, Apache 2.4.10) and discover that Apache's child processes are not closing properly (apparently they keep open ...
0
votes
0answers
99 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
0
votes
1answer
84 views

Server vulnerability scanning [closed]

How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security. Thanks in advance
63
votes
1answer
6k views

Who “brands” vulnerabilities?

It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who ...
2
votes
0answers
50 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
0
votes
1answer
118 views

The older the Linux kernel is, the more secure?

Are there security benefits running Linux Distro base on an older version of Linux kernel? Security benefits = fewer vulnerabilities that can be exploited by hackers. Linux Distro base on older ...
0
votes
0answers
63 views

Garbage collection and vulnerabilites

If I'm using vanilla PHP (v 5.x) procedural style, will there be garbage collection? As far as I understand GC, it is memory management to remove an unused object. This tells me that using PHP ...
1
vote
1answer
40 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
3answers
187 views

Is it possible to hack into secured wifi and download with bit torrent from my IP address?

Is it possible to hack into secured wifi and download using BitTorrent from my IP address? I live in Denmark- if that makes any difference. We changed to a new WIFI service provider a few years back (...
0
votes
0answers
39 views

Why 6.7 version of image magick can be exploitable even it is Vulnerable version?

I have installed a vulnerable version of the image magick i.e. 6.7 and according to this CVE-2016–3714 it is a vulnerable version. Now why I downloaded it because to get a clear picture of this ...
1
vote
1answer
228 views

What is NetSpectre?

A new attack was revealed in a document titled NetSpectre: Read Arbitrary Memory over Network (PDF warning). I've seen a few non-technical writeups about the fact that it's a pretty slow attack: ...
4
votes
2answers
112 views

Security of WWAN cards in laptops

I'm thinking about buying a WWAN card for my laptop (like this one here), as it is more convenient to use than USB tethering. However, I'm concerned about the security risk that comes with such a card ...
3
votes
1answer
201 views

strstr and fopen, is there a bypass?

I have a binary that does this: if (strstr(USERCONTROLLERSTRING, "..")) exit; fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r"); then spits out all the content of the file. Is there any ...
13
votes
6answers
8k views

What pages are vulnerable to SQL injection?

I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
3
votes
1answer
92 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
-1
votes
2answers
81 views

Extracting passwords from recycled machine using Spectre and Meltdown

With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
1
vote
1answer
32 views

Incomplete Data In Format String Dump

I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results. I made a sample program which has a ...
-2
votes
1answer
159 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
1
vote
1answer
113 views

Are the details about the Widevine bug now public?

There was a bug in Widevine last year which enabled downloading Encrypted Media Extension Content. They stated that they would give full details after 90 days. Was this meant for public disclosure or ...
0
votes
1answer
59 views

Oracle instance with embedded older version of Java within its directories flagged with numerous vulnerabilities

The issue is an Oracle instance with embedded older versions of Java within the Oracle directories that are being flagged with numerous vulnerabilities. Installing the April 2018 Oracle Java patch ...
-1
votes
1answer
178 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
1
vote
0answers
79 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
2answers
180 views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
1
vote
1answer
61 views

Could you use svchost to run any service?

Is it possible if per say you installed an "evil_service," to use svchost to run it? Will it run any service?
2
votes
1answer
108 views

How can an old hardware lead to a security failure?

I am working on critical cyber physical systems, and my work and research lead me to some questions. In the following, I assume that the attacker is not able to change the hardware of your system and ...