Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

166
votes
3answers
15k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
238
votes
4answers
108k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
-3
votes
3answers
12k views

How do I find vulnerabilities in software? [closed]

I read an answer here which talked about becoming a PenTester. The answer said that you have to learn to break software. I posted a comment on the answer asking where do I start learning to break ...
9
votes
3answers
970 views

Downloaded file checksums

More than often next to the download button of a file there is a variety of checksums. When I download a file what security risks am I exposed to if I don't check for its integrity?
14
votes
2answers
4k views

What are the privacy and security risks associated with Intel's Management Engine and AMD's Platform Security Processor?

And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me? Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely ...
13
votes
1answer
6k views

What is WebRTC and how can I protect myself against leaking information that doesn't need to be shared?

What is WebRTC and what is it intended to be used for? According to this Browser Leaks Test for WebRTC and IP Leaks, I am currently leaking IP information for IP addresses that I do not believe ...
9
votes
5answers
584 views

How to find out what vulnerabilities X product has had/has?

Canonical question regarding the best way of obtaining information on what vulnerabilities X product has had/has. Other identical or significantly similar questions should be closed as a duplicate of ...
7
votes
4answers
1k views

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
4
votes
3answers
942 views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
8
votes
3answers
2k views

How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?

This is a hypothetical question. The answers would help me to learn how CVE issues CVE IDs to vulnerabilities. Let us assume that I have followed the principles of responsible disclosure, reported ...
3
votes
3answers
7k views

Bypass x-frame-options for clickjacking

Is there any way to bypass the x-frame-options header without using a MitM or changing the packets in another way? So actually getting a site that has x-frame-options: DENY to be shown in an iframe.
-10
votes
2answers
364 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
4
votes
1answer
539 views

How to secure a router/modem? [closed]

I found a lot of resources about how to secure WiFi networks. This question is not about that. How can I make sure the software running on the modem/router is not exploitable to known security flaws? ...
41
votes
3answers
23k views

Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
48
votes
6answers
7k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to a ...
8
votes
3answers
17k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
23
votes
4answers
2k views

Cloudbleed: is it actually important to change ALL passwords?

In response to Google and Cloudflare's recent disclosures of the Cloudbleed vulnerability, some sources like TNW are recommending that people change passwords for sites and services that use ...
9
votes
4answers
4k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
1
vote
3answers
10k views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client &...
8
votes
2answers
5k views

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

I read about the security vulnerability that Intel explains here On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name. Their guide on ...
8
votes
1answer
1k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
7
votes
3answers
3k views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
7
votes
2answers
217 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
11
votes
3answers
633 views

How can malware immediately infect a Windows XP computer as soon as it goes online without any user action?

This is a thing I used to hear back in the olden days of Windows XP... People were telling me that a computer running on an out-of-date Windows XP system with no antivirus software was getting ...
5
votes
1answer
66 views

What are the EFAIL “backchannels in email clients not related to HTML”?

The published examples for exploiting the EFAIL email encryption vulnerability all appear to use HTML to create a backchannel for exfiltrating decrypted data. However, the homepage of EFAIL, https://...
4
votes
4answers
2k views

How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students; It used to use EAP, allowing students to enter their ...
4
votes
4answers
360 views

Client-Side Anti-XSS Measures

What are the reliable and stable client-side JavaScript libraries for XSS prevention and why? It would be very beneficial if you could provide details like: browser support conformity to any ...
3
votes
2answers
631 views

Can a KVM switch be vulnerable through a VGA port?

I have one KVM switch that has a VGA port to connect monitor. I want to know how to test that the KVM switch has no vulnerabilities by this port (using DDC)?
3
votes
3answers
2k views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: '...
1
vote
2answers
2k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
3
votes
2answers
219 views

How do hackers find vulnerabilities in closed source operating systems?

I'm not planning on hacking anything, but I'm just wondering how hackers find vulnerabilities in closed source operating systems such as Windows, since they don't know exactly what the code is doing? ...
2
votes
2answers
654 views

Is there a microcode or other hardware fix for Meltdown?

Linked to my question here, the MS support page states In addition to installing the January security update, a processor microcode update is required. But previous articles I've read said ...
0
votes
2answers
693 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones) [closed]

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
123
votes
8answers
18k views

Are there technical differences which make Linux less vulnerable to virus than Windows?

What makes Linux so different than Windows in terms of anti-virus needs? My question is not if I should get an anti-virus for my Linux. I perfectly understand why an AV is important. I would like ...
70
votes
3answers
28k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
53
votes
3answers
19k views

What kind of attack is prevented by Apache2's error code AH02032 (“Hostname provided via SNI and hostname provided via HTTP are different”)?

I saw in my Apache2 server logs messages like [ssl:error] [pid 28482] AH02032: Hostname xxx.yyy.zzz.www:443 provided via SNI and hostname xxx.yyy.zzz.www provided via HTTP are different One of ...
32
votes
2answers
5k views

HTML login form without a CSRF protection

We've recently got a vulnerability report saying that one of our HTML forms in one of the internal applications is not CSRF protected. At first, we could not immediately reproduce it manually using ...
35
votes
1answer
4k views

How does a nonce reset allow for decryption?

I'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption ...
13
votes
2answers
674 views

How to detect Rowhammer vulnerability?

Related to How to know whether a RAM module is vulnerable to rowhammer before buying?, how can I check whether my already installed memory modules are susceptible to this attack, without having to use ...
11
votes
3answers
11k views

What is a good XSS vector without forward slashes and spaces?

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
4
votes
4answers
5k views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
18
votes
1answer
36k views

What are the main vulnerabilities of TLS v1.1?

What are the main vulnerabilities of TLS v1.1? Actually, no RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except the description given in section 1.2 ...
12
votes
3answers
752 views

Are virtualized environments vulnerable to the Row Hammer attack?

Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system. To ...
9
votes
4answers
1k views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
8
votes
1answer
544 views

Attack vector for exploiting WhatsApp's retransmission “vulnerability”?

A few days ago, an old "vulnerability" of WhatsApp re-appeared in the media. The Guardian published this article calling the vulnerability a "backdoor". The article cites these findings of Tobias ...
19
votes
2answers
1k views

What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015?

It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's ...
7
votes
3answers
724 views

Does plain text mode offer complete protection against e-mail malware?

As far as I know, malware can spread with an email message either via an attachment file or a link that a user deliberately opens and via vulnerabilities in the email client in the JavaScript (if ...
5
votes
1answer
986 views

Automatically enumerate missing patches on penetration test

Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version. What is a good way of ...
5
votes
2answers
479 views

Identifying an ongoing exploit?

Recently I was contacted by a person saying that they had found a vulnerability in my site. They were able to prove it, by sending me a list of my own databases (some of which had been created but ...
-1
votes
2answers
7k views

Does having these ports open indicate any vulnerabilities?

I installed Ubuntu Gnome a couple of weeks ago along with a few packages and some software. When I scanned my localhost using Nmap, I got the following results. Are there any obvious vulnerabilities, ...