Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
171 votes
3 answers
16k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
user avatar
  • 13k
248 votes
4 answers
112k views

SSL3 "POODLE" Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
user avatar
  • 82k
0 votes
3 answers
22k views

How do I find vulnerabilities in software? [closed]

I read an answer here which talked about becoming a PenTester. The answer said that you have to learn to break software. I posted a comment on the answer asking where do I start learning to break ...
user avatar
  • 153
16 votes
2 answers
6k views

What are the privacy and security risks associated with Intel's Management Engine and AMD's Platform Security Processor?

And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me? Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely ...
user avatar
10 votes
3 answers
6k views

How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it? [duplicate]

This is a hypothetical question. The answers would help me to learn how CVE issues CVE IDs to vulnerabilities. Let us assume that I have followed the principles of responsible disclosure, reported ...
user avatar
13 votes
1 answer
7k views

What is WebRTC and how can I protect myself against leaking information that doesn't need to be shared?

What is WebRTC and what is it intended to be used for? According to this Browser Leaks Test for WebRTC and IP Leaks, I am currently leaking IP information for IP addresses that I do not believe ...
user avatar
  • 3,344
62 votes
3 answers
7k views

Security risks of fetching user-supplied URLs

We are considering to add the following feature to our web application (an online product database, if it matters): Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
user avatar
  • 2,914
16 votes
1 answer
20k views

How does the EternalBlue Exploit Work?

I've casually googled for explanations on how exactly the EternalBlue exploit works but, I suppose given the media storm about WannaCry, I've only been able to find resources that at best say it's an ...
user avatar
  • 281
10 votes
3 answers
1k views

Downloaded file checksums

More than often next to the download button of a file there is a variety of checksums. When I download a file what security risks am I exposed to if I don't check for its integrity?
user avatar
9 votes
5 answers
2k views

How to find out what vulnerabilities X product has had/has?

Canonical question regarding the best way of obtaining information on what vulnerabilities X product has had/has. Other identical or significantly similar questions should be closed as a duplicate of ...
user avatar
7 votes
4 answers
1k views

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
user avatar
4 votes
3 answers
1k views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
user avatar
-9 votes
2 answers
473 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
user avatar
  • 977
14 votes
3 answers
2k views

How can malware immediately infect a Windows XP computer as soon as it goes online without any user action?

This is a thing I used to hear back in the olden days of Windows XP... People were telling me that a computer running on an out-of-date Windows XP system with no antivirus software was getting ...
user avatar
  • 5,587
141 votes
17 answers
23k views

Is exploit-free software possible?

I have heard that there will always be vulnerabilities in codes, software. However, I don't understand why it is not possible to have an exploit-free software. If companies keep updating their ...
user avatar
  • 1,165
41 votes
11 answers
17k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
user avatar
  • 543
50 votes
6 answers
7k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to a ...
user avatar
  • 501
41 votes
3 answers
23k views

Are ordinary OS X desktops at risk from bash "shellshock" bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
user avatar
  • 2,100
9 votes
3 answers
19k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
user avatar
  • 1,971
39 votes
2 answers
73k views

What are the main vulnerabilities of TLS v1.1?

What are the main vulnerabilities of TLS v1.1? Actually, no RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except the description given in section 1.2 ...
user avatar
  • 565
15 votes
2 answers
6k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
user avatar
23 votes
4 answers
2k views

Cloudbleed: is it actually important to change ALL passwords?

In response to Google and Cloudflare's recent disclosures of the Cloudbleed vulnerability, some sources like TNW are recommending that people change passwords for sites and services that use ...
user avatar
9 votes
4 answers
7k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
user avatar
  • 301
4 votes
2 answers
17k views

Bypass x-frame-options for clickjacking

Is there any way to bypass the x-frame-options header without using a MitM or changing the packets in another way? So actually getting a site that has x-frame-options: DENY to be shown in an iframe.
user avatar
  • 879
2 votes
3 answers
17k views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client &...
user avatar
  • 233
8 votes
2 answers
5k views

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

I read about the security vulnerability that Intel explains here On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name. Their guide on ...
user avatar
  • 260
7 votes
3 answers
4k views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
user avatar
  • 231
6 votes
1 answer
150 views

What are the EFAIL "backchannels in email clients not related to HTML"?

The published examples for exploiting the EFAIL email encryption vulnerability all appear to use HTML to create a backchannel for exfiltrating decrypted data. However, the homepage of EFAIL, https://...
user avatar
  • 1,625
4 votes
4 answers
2k views

How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students; It used to use EAP, allowing students to enter their ...
user avatar
4 votes
4 answers
899 views

Client-Side Anti-XSS Measures

What are the reliable and stable client-side JavaScript libraries for XSS prevention and why? It would be very beneficial if you could provide details like: browser support conformity to any ...
user avatar
  • 741
4 votes
3 answers
4k views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: '...
user avatar
  • 213
3 votes
2 answers
1k views

Can a KVM switch be vulnerable through a VGA port?

I have one KVM switch that has a VGA port to connect monitor. I want to know how to test that the KVM switch has no vulnerabilities by this port (using DDC)?
user avatar
  • 187
1 vote
2 answers
2k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
user avatar
  • 1,457
8 votes
1 answer
352 views

How to be taken seriously when doing responsible disclosure?

Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input ...
user avatar
  • 584
4 votes
2 answers
3k views

How do hackers find vulnerabilities in closed source operating systems?

I'm not planning on hacking anything, but I'm just wondering how hackers find vulnerabilities in closed source operating systems such as Windows, since they don't know exactly what the code is doing? ...
user avatar
3 votes
1 answer
514 views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
user avatar
  • 271
2 votes
2 answers
785 views

Is there a microcode or other hardware fix for Meltdown?

Linked to my question here, the MS support page states In addition to installing the January security update, a processor microcode update is required. But previous articles I've read said ...
user avatar
  • 194
1 vote
1 answer
623 views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
user avatar
0 votes
2 answers
817 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones) [closed]

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
user avatar
  • 275
124 votes
8 answers
20k views

Are there technical differences which make Linux less vulnerable to virus than Windows?

What makes Linux so different than Windows in terms of anti-virus needs? My question is not if I should get an anti-virus for my Linux. I perfectly understand why an AV is important. I would like ...
user avatar
52 votes
5 answers
40k views

Can malicious code trigger without the user executing or opening the file?

If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger? ...
user avatar
  • 537
71 votes
3 answers
36k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
user avatar
61 votes
3 answers
35k views

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

I saw in my Apache2 server logs messages like [ssl:error] [pid 28482] AH02032: Hostname xxx.yyy.zzz.www:443 provided via SNI and hostname xxx.yyy.zzz.www provided via HTTP are different One of ...
user avatar
33 votes
2 answers
8k views

HTML login form without a CSRF protection

We've recently got a vulnerability report saying that one of our HTML forms in one of the internal applications is not CSRF protected. At first, we could not immediately reproduce it manually using ...
user avatar
  • 1,505
35 votes
1 answer
4k views

How does a nonce reset allow for decryption?

I'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption ...
user avatar
  • 472
15 votes
1 answer
425 views

Why is caller ID spoofing so simple, and catching offenders so hard?

There is plenty of software which allows a user to input a recipient's information, and a fake-originator's information, and the software will complete the caller ID spoof. I'm trying to understand ...
user avatar
7 votes
4 answers
12k views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
user avatar
  • 6,204
14 votes
2 answers
2k views

How to detect Rowhammer vulnerability?

Related to How to know whether a RAM module is vulnerable to rowhammer before buying?, how can I check whether my already installed memory modules are susceptible to this attack, without having to use ...
user avatar
  • 2,961
11 votes
2 answers
27k views

Why JMP ESP instead of directly jumping into the stack

Firstly, I'm sorry if this post doesn't fit exactly here, or may be fit better in RE. We could move it if necessary. So, I was reading this writeup about an exploit in vulnserver (for those who don't ...
user avatar
13 votes
3 answers
1k views

Are virtualized environments vulnerable to the Row Hammer attack?

Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system. To ...
user avatar