Questions tagged [vulnerability-markets]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer

Recent attacks and vulnerabilities [closed]

How can I be up to date and get news on recent attacks and vulnerabilities? Is there any trusted source of information (websites, databases, ...)
user avatar
3 votes
1 answer

Do companies shop for 0-days on black markets to fix them?

Is it known for software development companies to shop for 0-day vulnerabilities on black markets in order to burn them? Microeconomics tell me "no", as some sources claim that 0-days are short in ...
vadkou's user avatar
  • 133
2 votes
1 answer

How to justify a Vulnerability Research function at a company

From a business standpoint, how would you express the need for a vulnerability research team? In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
grepNstepN's user avatar
5 votes
2 answers

Is there an estimation of the number of zero-days out there?

A zero day vulnerability refers to a hole in software that is unknown to the vendor. Since, zero day vulnerabilities are unknown can any estimation of amounts be made? What are possible scenarios to ...
Bob Ortiz's user avatar
  • 6,665
1 vote
2 answers

Is there a practical way to identify security vulnerabilities that were published following a full disclosure policy?

I am conducting a study about the different vulnerability disclosure policies in an effort to determine how long it takes for a given vendor to issue a fix/patch, depending on how a given ...
AleVe's user avatar
  • 11
8 votes
2 answers

What does "exploit price" on means?

I was checking, and they state in one of the boxes: Top vulnerabilities with the highest current exploit price of the current month. The evaluation happens multiple times per day. What ...
lepe's user avatar
  • 2,194
1 vote
2 answers

What information to provide when submitting a vulnerability report to a bounty program?

After finding a vulnerability in a program, one can submit it to a bounty program, such as ZDI. According to ZDI's website, they will examine the vulnerability and possibly offers a bounty. If the ...
ZillGate's user avatar
  • 364
1 vote
3 answers

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
elsadek's user avatar
  • 1,862
1 vote
3 answers

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
Harikrishnan's user avatar
2 votes
1 answer

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
daniel__'s user avatar
  • 131
6 votes
3 answers

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
Anonymous's user avatar
10 votes
2 answers

What are the likely effects of increased government spending on "Cyber Weapons" on the software industry?

From the conference scene and news this year it seems probable that there's an increased amount of spending from governmental agencies on what it getting termed "Cyber Weapons". A key component of ...
Rory McCune's user avatar
  • 62.3k
10 votes
2 answers

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
blunders's user avatar
  • 5,072
7 votes
2 answers

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
blunders's user avatar
  • 5,072
11 votes
3 answers

Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder ...
nealmcb's user avatar
  • 20.8k