Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Fuzzing with SPIKE for HTTP and FTP [closed]

I wanted to know is there anyone doing fuzzing in SPIKE? I know SPIKE is quite old and almost every page says it has bad documentation. I found some pages but they all have the same pattern fuuzing ...
0
votes
0answers
68 views

Which bug allowed the december 2020 cyber attack on Solarwinds? [closed]

I know it may be not good to share security bugs details in public as it may be really critical but could someone explain the exact scenario of the attack on Solarwinds systems ; I think this may be ...
2
votes
1answer
93 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
0
votes
2answers
113 views

Nexpose Vulnerability scanner

Is it normal to get 3000+ vulnerabilities while scanning server using Nexpose? Or I can reduce the vulnerability to decent count by some tweaks!
4
votes
0answers
89 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
4
votes
2answers
208 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
0
votes
0answers
45 views

Is malware in an EC firmware a concern, when standard security is in place together with the rest of the computer having no malevolent tampering?

Question My question is whether malware in the embedded-controller firmware is something to worry about if the rest of the computer system is faithfully what it should be, together with standard ...
0
votes
1answer
37 views

can vulnerabilities be treated differently based on ceratin circumstances? [duplicate]

We are running vulnerability scans on our systems. I can see a few XSS vulnerabilities being reported, such as CVE-2020-14173. Let me quote: The file upload feature in Atlassian Jira Server and Data ...
1
vote
0answers
40 views

Remote file inclusion (RFI) found - vulnerability or false positive?

For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
90
votes
6answers
14k views

Why does my IT department block Firefox?

We received a message from the IT bods this week stating: Summary of the issue: IT will disabling and blocking the use of the browser Firefox next Thursday the 03.12.20 on all IT managed devices. Due ...
3
votes
1answer
369 views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
3
votes
2answers
68 views

How to estimate threat and risk associated with that threat and not only vulnerability severity?

Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part. I ...
3
votes
0answers
81 views

Can/should I automatically report network break-in attempts?

For the last 15 years I've been using SpamCop to report the spam I receive. I do this because it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
0
votes
1answer
41 views

Using outdated ADSL modem with up to date router - Security Concerns

My parents live way out in the middle of nowhere. The only service provider that is not satellite is Century Link, which uses ADSL / phone lines. They wanted me to set them up, and the service guy was ...
1
vote
1answer
74 views

Is it possible for a self-extracting file to run malware on Linux?

I know that you need to change permissions for a file to run as a script on Linux. Is that enough to prevent any malware from being installed by some self-extracting file? Is there anything that can ...
0
votes
1answer
266 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
1
vote
1answer
126 views

Can string concatenation in file_get_contents() be exploited in PHP?

Let's say I have the following PHP code: <?php echo file_get_contents($_GET['path'] . ".txt"); Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
0
votes
1answer
75 views

Is it possible for someone to make a purposefully vulnerable site then take advantage of that vulnerability to hack the users?

Is it possible for someone to make a purposefully vulnerable site then lure users to his site where he then takes advantage of that vulnerability to hack their social media accounts etc? If so how?
0
votes
0answers
53 views

Can python be used to retrieve a session ID to mimic logged in user at periodical times?

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
0
votes
4answers
101 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
0
votes
1answer
100 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
1
vote
1answer
107 views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
1
vote
0answers
48 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
2
votes
1answer
121 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
2answers
58 views

Possible SSRF in image tag that takes (partial) user input?

A webapp has an img tag that partially takes userinput like so: <img src="/blah/blah/$USERINPUT.jpg"> where the first / is from the root of the domain. Could there be a vulnerability ...
1
vote
1answer
78 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
1answer
98 views

How can I tell if a program (in this case Jitsi Meet Electron) has bad-enough vulnerablities making it unsafe for current use and/or protect myself? [closed]

I'm uneasy that Jitsi Meet (videoconferencing stack) is Chrome-first (bug relating to other browsers are fixed later) and dislike Chrome for privacy reasons. Jitsi has an Electron desktop web-wrapper ...
-1
votes
1answer
57 views

Is there any document that contains all web vulnerabilities of OWASP? [closed]

OWASP top 10 lists the top 10 web security risks. But I didn't find the other vulnerabilities out of the top 10 in OWASP site. Is there any document that contains all web vulnerabilities?
0
votes
1answer
65 views

Is there any authoritative classification of vulnerabilities?

Is there any classification of vulnerabilities ? As we know, there are many vulnerabilities, such as: SQL injection vulnerability, File upload vulnerability, File contains vulnerability, XSS, SSRF, ...
1
vote
1answer
177 views

Slow HTTP POST vulnerability in IIS 10

I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer. From what I understood from this finding, ...
0
votes
1answer
115 views

Are rich-client apps inherently more secure than webapps? [closed]

If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF ...
0
votes
1answer
44 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
1answer
64 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
0
votes
1answer
51 views

Booting 'live' form the hard disk

I use VeraCrypt for file-container level encryption for all of my files. But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
-1
votes
2answers
105 views

Can someone Inject malicious SQL to my SQL query? [closed]

I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID. Is there a way someone can Inject malicios ...
0
votes
1answer
126 views

What are the security risks of allowing users to add iframes?

In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags. I'd like to allow <iframe> so that users can insert youtube videos and so on. However I'm worried ...
2
votes
2answers
125 views

Are call stack addresses predictable with all protections disabled?

I'm currently practicing buffer overflows, but there is one thing I don't understand yet. I have read this similar question. I understand that if you don't know the address of ESP you must look for an ...
0
votes
1answer
56 views

Is it considered as a DOS attack if I add too much data to a page so that it doesn't respond at all?

I am working on an application. There is a new feature implemented where a user create some IDs and secret keys for that application. I have observed that there is no rate limit for creating those. I ...
1
vote
1answer
138 views

How to make use of a exploit that is not available in metasploit? [closed]

I want to exploit a Microsoft IIS HTTPD 10.0 server open which is open in PORT 80. However there is no available exploits in Metasploit but there are few vulnerabilities in this site. Is it possible ...
-1
votes
1answer
75 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
1
vote
2answers
124 views

Assigning static IP address other than 127.0.0.0/8 to loopback interface

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to ...
0
votes
0answers
62 views

How would you investigate if CoronaBlue has been exploited by an attacker or not?

How would you investigate if CVE-2020-0796 (Windows SMBv3 Client/Server Remote Code Execution Vulnerability) has been exploited by an attacker or not?
0
votes
1answer
208 views

How did I get hacked and what was accessed?

Two days ago I installed a new router. It was a new TPlink AC1900. I established a password for the web admin, went through the quick setup questions, changed the IP ranges for the DHCP service from ...
0
votes
1answer
491 views

ATM CVV1 + Service Code, POS Security Flaw?

I'm new to this topic and I found it very interesting how all the payment system is currently working. To be honest it look like they are not doing enough to stop fraudulent activity with Credit Cards....
0
votes
1answer
142 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
1
vote
2answers
919 views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
0
votes
0answers
50 views

Connecting to REST server w/ digest auth using postman

Im having a hard time with a CTF, i managed to exploit a path traversal vulnerability that lead me to read a configuration file in php that indicates: define('rest_auth', 'digest'); define('...
1
vote
0answers
56 views

What is this “prepare” variable used for in this SEH based buffer overflow payload?

I am trying to understand how a SEH based buffer overflow is working and I have to write a paper about how an exploit works. I took this PoC for my paper. junk = "\x41" * 4091 nseh = "\x61\x62" seh ...
1
vote
1answer
99 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
1
vote
4answers
217 views

What are the names of software vulnerabilities? [closed]

In web apps there are vulnerabilities like SQLi or XSS and many more. I heard that for hackers to hack a computer they have to find a vulnerability in a software that is running on an open port. ...

1
2 3 4 5
18