Questions tagged [vulnerability-assessment]
The vulnerability-assessment tag has no usage guidance.
56
questions
0
votes
1answer
51 views
If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?
If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices?
Or is each VPN connection creating its own ...
0
votes
0answers
30 views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
0
votes
1answer
46 views
Risk of web admin portal without extra authentication steps
more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet ...
0
votes
4answers
169 views
Accessing user data by a public 'token' - is it a potential vunabilility?
I joined a small project, I noticed that in the project uses something like a token associated with a user journey. So the URL looks something like: https://host.com/sell/:jurneyID.
All data entered ...
1
vote
2answers
56 views
AES Traffic Security Assesment
Assume we have only access to the traffic between two module (Hardware, Software, ...) and These modules communicate with SSL (PSK).
Is it possible to assess AES encryption of this traffic?
some ...
1
vote
0answers
20 views
Version earlier than 0 in Debian OVAL feeds
I'm trying to parse Debian OVAL feeds to establish if some packages are vulnerable or not. I'm using criterions to establish what's the vulnerable version for a package, however often there are ...
1
vote
0answers
50 views
Threat modelling workshop materials focusing on threat actor profiles [closed]
A while back I went to a threat modelling workshop that had a card deck with various actors, their motivations, and their methods.
I found this extremely helpful to frame the discussion around the ...
1
vote
1answer
101 views
Is it reasonable to provide admin access for a PCI vulnerability scan?
My organization is going through a PCI-DSS compliance process. As part of that, we're contracting out our external and internal vulnerability scans.
The contractor is asking for admin access to our ...
0
votes
0answers
45 views
Pre-flight request is triggering in Chrome but not in IE
I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
0
votes
0answers
63 views
Identifying Share Permission and File Permission on Hundreds of Servers
Objective
Identify and report on Windows hosts in the network which allow file/folder access (READ/WRITE/Execute) for Everyone.
Scenario:
Using agent based scanner, I extracted share permissions ...
2
votes
3answers
175 views
Do I need to worry about vulnerabilities that require administrative privileges to exploit?
I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines.
What confuses me is that fact that those vulerabilities are scored with
a high risk score, but
require(...
1
vote
1answer
75 views
XSS vulnerability in a module that doesn't exist
We did a vulnerability scan on our systems and received a vulnerability:
Basit Submit Module Cross Site Scripting Vulnerability.
We are not even aware of this application on our system. We filed a ...
3
votes
1answer
220 views
Are there any known vulnerabilities in libre office password protection for *.odt files?
I was looking for a source to determine the safety of password protection in libre office. The thread at ask.libreoffice.org suggest its save to use. However the thread is rather old and it is hosted ...
0
votes
0answers
56 views
CIS-CAT tool on german windows
I'm using the cis cat tool (https://learn.cisecurity.org/cis-cat-landing-page) to audit the windows policies on my windows machine (german localisation).
The cis cat tools reports a lot of false ...
0
votes
0answers
162 views
Can OpenVAS do a scan on a scanner device?
I know OpenVAS can scan printers with just tweaking some scan configuration.
I try to scan a scanner device but I only get one result which is OS Detection Consolidation and Reporting.
I have an ...
1
vote
0answers
64 views
What would you do as first day of CSO or Head of CyberSecurity [closed]
I was asked this question at an interview today and was unable to give a structured answer since there is so many things a head of security can do.
The additional info that I had were :
- You can ...
1
vote
3answers
179 views
Vulnerability management and assessment tracking solutions
How does your company track the vulnerability management information that happens between receiving a vulnerability scan report and remediating a vulnerability?
Given the following example:
Scan A ...
7
votes
1answer
705 views
Security risks of using ffmpeg as part of web service
I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
0
votes
2answers
105 views
PHP Code Injection vulnerability exists even after recommended hardening
Using Burp to intercept traffic and inject code we have identified
remote code execution vulnerability in a website. After entering data
in input fields on the form and clicking submit the traffic ...
1
vote
0answers
18 views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
1
vote
1answer
119 views
What information should I provide to third party pen testers - (black box penetration)
I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
1
vote
1answer
182 views
Internal HTTP(s) vulnerabilities
We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
2
votes
1answer
26 views
Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )
I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
1
vote
2answers
809 views
How to discover known vulnerabilities (CVEs) in Go executables? [closed]
Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.
Would it be possible to do ...
1
vote
1answer
154 views
PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure
I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting:
HTTP (443/tcp) - Web Application Cookies Not Marked Secure
Per our ...
1
vote
2answers
218 views
Is RIPv2 MD5 authentication insecure?
While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
0
votes
1answer
107 views
Server vulnerability scanning [closed]
How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security.
Thanks in advance
2
votes
2answers
81 views
is there evidence that security vulnerability “severity formulas” are more useful than just eyeballing it?
There are some formulas for risk-assessing security vulnerabilities, like the DREAD formula (Damage, Reproducibility, Exploitability, Affected users, Discoverability -- rate the vuln in each category ...
9
votes
3answers
2k views
Is “Discoverability = low” an acceptable reason to reduce the risk of a vulnerability?
The outdated DREAD risk model (wikipedia) lists Discoverability as a criteria for judging the severity of a vulnerability. The idea being that something which is not publicly known and you would be ...
2
votes
1answer
542 views
Could you use svchost to run any service?
Is it possible if per say you installed an "evil_service," to use svchost to run it? Will it run any service?
2
votes
1answer
185 views
owasp top 10 2017 automation
I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
1
vote
0answers
144 views
Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs
I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup?
I used Attack Surface ...
1
vote
1answer
567 views
Is it safe to install Xampp to learn Security and Penetration testing using DVWA? [duplicate]
I have heard Xampp is not safe and has a lot of security loopholes. What steps need to be taken to close the loopholes? Is it better if I use a VM instead?
I new to Security Testing and want to learn ...
4
votes
2answers
3k views
OpenVAS won't generate SCAP Database
To deploy OpenVAS to Virtual machines I've been using Ansible for a while and it worked pretty well. Now today I wanted to deploy it to another machine but the openvas-check-setup script keeps telling ...
3
votes
1answer
116 views
To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?
I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
1
vote
0answers
341 views
CVSS Alternatives? [closed]
I am looking for suggestions of alternatives to vulnerability scoring systems such as CVSS & DREAD.
I have found that DREAD is too subjective to work and CVSS was ranking everything too highly ...
4
votes
3answers
214 views
How to maintain balance between integrity and client satisfaction in vulnerability assessments
I have done a number of vulnerability assessments and I'm noticing a trend. In the first assessment the clients are impressed and grateful for the massive security holes I find. During the second ...
2
votes
3answers
126 views
Identification of TLS POODLE Vulnerability
How can I identify whether the remote server is vulnerable to TLS POODLE vulnerability? Although, there are online scanners such as Qualys SSL Labs. As per my understanding, these online scanners do ...
0
votes
1answer
1k views
SSL cookie without secure flag set situation for “Authorization: Bearer”
I am currently reviewing an web application which dose use Cookies (non authentication related) without secure flag set but uses an "background" API to retrieve authenticated data using Authorization: ...
0
votes
1answer
339 views
Using OWASP Top 10 for assigning vulnerability severity in a security assessment
In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are ...
1
vote
0answers
23 views
Aptitude & Yum: Studies on Actual Security
The theory has long been that package managers (and potentially other sources of FOSS) were potentially "more secure" and/or "more trustworthy" than commercial software because more people's eyes have ...
12
votes
2answers
3k views
Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners
Performed credentialed Vulnerability scan on linux/Unix servers by Nessus and thousand of vulnerability came out of port tcp/0. How could a IANA reserved port(tcp/0) handle traffic? Are those ...
2
votes
1answer
933 views
PHP File Upload Vulnerability
I'm assessing the security of a webportal for a client and I found a vulnerability.
I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function ...
1
vote
0answers
36 views
Is using AWS and administered VMs a reasonable and feasible secure environment?
I'm currently tasked with exploring options for hosting secure data for our company that don't require setting up any in-house infrastructure as we don't currently have any. Everyone is a developer ...
105
votes
15answers
21k views
How can I argue against: “System is unhackable so why patch vulnerabilities?”
An operating system has reached End of Support (EoS) so no more security patches are coming for the OS ever. An embedded device running this OS needs to be updated to a newer version. However, the ...
2
votes
2answers
76 views
What is the best way to analyze results of a technical security assessment? [closed]
I want to conduct a technical security assessment on my company's client computers with focus on Windows 10.
So far, my idea is to execute several Powershell scripts on the clients and gather the ...
2
votes
2answers
3k views
Buffer Overflow doesn't have enough space for exploit after being crashed
So I'm trying to write a buffer overflow for a knowingly vulnerable server application, I want to learn how to do this on my own and just want some direction.
I'm watching it in immunity debugger on ...
5
votes
2answers
936 views
Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application
As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which ...
5
votes
2answers
385 views
Why are the CVSS scores differ so much between Redhat and NVD page?
take CVE-2016-7872 for example.
in National Vulnerability Database webpage, we can see that the cvss2 and cvss3 score are 9.8 and 10.0 respectively.
but in the redhat security advisory page, they ...
4
votes
2answers
163 views
Way of categorising and organising types of security issues and areas
I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
