Questions tagged [vulnerability-assessment]
The vulnerability-assessment tag has no usage guidance.
73
questions
2
votes
1
answer
121
views
what is dynamic code analysis? is it the same as DAST (Dynamic application security testing)?
I'm confused a bit between the terms, what I know is there is SAST and DAST, SAST is scanning code statically for possible vulnerabilities, this is done usually b automated tools, also equivalent to ...
0
votes
0
answers
19
views
Does process injection through file on a low privilege user considered as a vulnerability
I found a way to cause a low privileged program in Program Files to run any binary I want.
I am doing it by changing a configuration file it reads, which I of course have an access to.
Is it ...
- 151
0
votes
0
answers
38
views
How do we indicate if a sub-techniques or techniques have a low or high detection confidence via MITRE ATT&CK?
I was doing the MITRE ATT&CK SOC Assessment course and had a question about the right assessment of techniques and sub-techniques.
The sub-technique that we want to assess is "Application or ...
0
votes
1
answer
87
views
Security for a Windows application running in a corporate network
I know security is pretty important for the web application, but what about windows applications running in a corporate environment, network, not accessible from outside.
Do we need to treat security ...
- 101
2
votes
1
answer
827
views
RCE vs ACE vulnerability families
Is RCE (Remote Code Execution) just ACE (Arbitrary Code Execution) over a network or is there an example where RCE is not ACE? Is RCE always the more severe of the two (with respect to gaining system ...
- 83
1
vote
1
answer
84
views
Is an outdated library in a Windows user mode desktop application an actual security risk?
I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".
As an example:
This ...
- 1,247
1
vote
1
answer
318
views
What is difference & link between threat modelling and vulnerability assessment?
My understanding is that, threat modelling is used at the design stage to identify the possible threats, prioritize them and help in identifying security requirements/security controls. Vulnerability ...
- 181
7
votes
1
answer
266
views
What exactly is CVE-2021-23978 (from MSFA2021-08 in Mozilla Firefox)?
A number of vulnerabilities were fixed in Firefox in the latest update. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information:
Mozilla ...
- 64k
1
vote
1
answer
131
views
What are the risks associate with accessing Same web application with two different URLs?
We have done vulnerability analysis with third party security team. They have mentioned one point as critical findings but i don't understand risk associated with it and suggested remedial action also ...
- 658
0
votes
1
answer
101
views
Cryptographic File Storage scheme
First of all,I am new to security as a whole and taking my first formal course on it.So sorry if any major errors are present.
I had a scheme for remote file storage as an attempt to use my course ...
- 103
1
vote
1
answer
71
views
How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?
Let's consider the following code in a hypothetical C library.
uint8_t size;
uint8_t buf[128];
read(untrusted_fd, &size, 1);
read(untrusted_fd, buf, size);
In the early 2000s, it would be a ...
- 113
1
vote
0
answers
112
views
Remote file inclusion (RFI) found - vulnerability or false positive?
For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
- 413
2
votes
1
answer
172
views
GraphQL endpoint security testing
I am working with a team who is developing a mobile app for which they are using GraphQL.
So as part of performing security testing it, they only shared the graphql endpoint and nothing else.
Not even ...
- 343
0
votes
4
answers
333
views
Application is validating the file extension but not file content - Is this a security vulnerability?
An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
- 33
0
votes
2
answers
351
views
Are smart plugs safe? (Xiaomi in particular)
Are smart plugs safe, Xiaomi ones in particular (Zigbee and WI-FI versions)?
My main concern is that the plug is connected to Mi account and allows remote management. In case hacker gains access, can ...
- 127
1
vote
1
answer
108
views
Security assessment of a legacy SSL/TLS implementation on an IoT device
I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation.
The mode of assessment is ...
- 163
1
vote
0
answers
183
views
Collaboration tools [closed]
Is there any good alternatives to the lair-framework. I think that was an awesome platform, and unfortunately its not maintained anymore and no more updates to it. But i have tried all other kinds of ...
- 11
0
votes
1
answer
81
views
How vulnerability assessment is different for application and infrastructure?
I am working for a company where vulnerability assessment for infrastructure and applications are being done by different vendors. Sometimes I get confused that assessment should happen on the ...
1
vote
2
answers
4k
views
If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?
If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices?
Or is each VPN connection creating its own ...
- 33
0
votes
0
answers
91
views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
- 101
3
votes
4
answers
261
views
Risk of web admin portal without extra authentication steps
more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet ...
- 31
0
votes
4
answers
207
views
Accessing user data by a public 'token' - is it a potential vunabilility?
I joined a small project, I noticed that in the project uses something like a token associated with a user journey. So the URL looks something like: https://host.com/sell/:jurneyID.
All data entered ...
- 63
1
vote
2
answers
117
views
AES Traffic Security Assesment
Assume we have only access to the traffic between two module (Hardware, Software, ...) and These modules communicate with SSL (PSK).
Is it possible to assess AES encryption of this traffic?
some ...
- 165
3
votes
0
answers
96
views
Version earlier than 0 in Debian OVAL feeds
I'm trying to parse Debian OVAL feeds to establish if some packages are vulnerable or not. I'm using criterions to establish what's the vulnerable version for a package, however often there are ...
1
vote
0
answers
106
views
Threat modelling workshop materials focusing on threat actor profiles [closed]
A while back I went to a threat modelling workshop that had a card deck with various actors, their motivations, and their methods.
I found this extremely helpful to frame the discussion around the ...
- 11
1
vote
1
answer
155
views
Is it reasonable to provide admin access for a PCI vulnerability scan?
My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans.
The contractor is asking for admin access to our ...
- 13
0
votes
0
answers
81
views
Pre-flight request is triggering in Chrome but not in IE
I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
- 33
0
votes
0
answers
154
views
Identifying Share Permission and File Permission on Hundreds of Servers
Objective
Identify and report on Windows hosts in the network which allow file/folder access (READ/WRITE/Execute) for Everyone.
Scenario:
Using agent based scanner, I extracted share permissions ...
- 185
2
votes
3
answers
265
views
Do I need to worry about vulnerabilities that require administrative privileges to exploit?
I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines.
What confuses me is that fact that those vulerabilities are scored with
a high risk score, but
require(...
- 2,914
1
vote
1
answer
132
views
XSS vulnerability in a module that doesn't exist
We did a vulnerability scan on our systems and received a vulnerability:
Basit Submit Module Cross Site Scripting Vulnerability.
We are not even aware of this application on our system. We filed a ...
- 23
3
votes
1
answer
996
views
Are there any known vulnerabilities in libre office password protection for *.odt files?
I was looking for a source to determine the safety of password protection in libre office. The thread at ask.libreoffice.org suggest its save to use. However the thread is rather old and it is hosted ...
- 161
0
votes
0
answers
234
views
Can OpenVAS do a scan on a scanner device?
I know OpenVAS can scan printers with just tweaking some scan configuration.
I try to scan a scanner device but I only get one result which is OS Detection Consolidation and Reporting.
I have an ...
- 13
1
vote
0
answers
105
views
What would you do as first day of CSO or Head of CyberSecurity [closed]
I was asked this question at an interview today and was unable to give a structured answer since there is so many things a head of security can do.
The additional info that I had were :
- You can ...
1
vote
3
answers
638
views
Vulnerability management and assessment tracking solutions
How does your company track the vulnerability management information that happens between receiving a vulnerability scan report and remediating a vulnerability?
Given the following example:
Scan A ...
- 23
8
votes
1
answer
3k
views
Security risks of using ffmpeg as part of web service
I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
- 183
0
votes
2
answers
232
views
PHP Code Injection vulnerability exists even after recommended hardening
Using Burp to intercept traffic and inject code we have identified
remote code execution vulnerability in a website. After entering data
in input fields on the form and clicking submit the traffic ...
1
vote
0
answers
58
views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
2
votes
1
answer
179
views
What information should I provide to third party pen testers - (black box penetration)
I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
- 658
1
vote
1
answer
397
views
Internal HTTP(s) vulnerabilities
We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
- 19
2
votes
1
answer
73
views
Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )
I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
- 31
2
votes
2
answers
2k
views
How to discover known vulnerabilities (CVEs) in Go executables? [closed]
Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.
Would it be possible to do ...
- 121
1
vote
1
answer
439
views
PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure
I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting:
HTTP (443/tcp) - Web Application Cookies Not Marked Secure
Per our ...
- 31
1
vote
2
answers
437
views
Is RIPv2 MD5 authentication insecure?
While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
- 475
0
votes
1
answer
155
views
Server vulnerability scanning [closed]
How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security.
Thanks in advance
user181612
2
votes
2
answers
128
views
is there evidence that security vulnerability "severity formulas" are more useful than just eyeballing it?
There are some formulas for risk-assessing security vulnerabilities, like the DREAD formula (Damage, Reproducibility, Exploitability, Affected users, Discoverability -- rate the vuln in each category ...
- 653
9
votes
3
answers
3k
views
Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?
The outdated DREAD risk model (wikipedia) lists Discoverability as a criteria for judging the severity of a vulnerability. The idea being that something which is not publicly known and you would be ...
- 57k
2
votes
1
answer
985
views
Could you use svchost to run any service?
Is it possible if per say you installed an "evil_service," to use svchost to run it? Will it run any service?
- 91
2
votes
1
answer
251
views
owasp top 10 2017 automation
I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
- 190
1
vote
0
answers
207
views
Windows Possible Vectors for Privilege Escalation From "Weak" Folder ACLs
I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup?
I used Attack Surface ...
- 91
2
votes
1
answer
945
views
Is it safe to install Xampp to learn Security and Penetration testing using DVWA? [duplicate]
I have heard Xampp is not safe and has a lot of security loopholes. What steps need to be taken to close the loopholes? Is it better if I use a VM instead?
I new to Security Testing and want to learn ...
- 123