Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

1
vote
1answer
315 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
0
votes
0answers
108 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
2
votes
3answers
131 views

Do WordPress vulnerabilities matter in intranet?

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only ...
0
votes
1answer
68 views

How secure is a serial/terminal/console server, from the serial side?

I'm upgrading my home lab, and one of the things I'm planning on introducing this time is out-of-band management through a Raspberry Pi console server similar to this: https://www.packet6.com/...
1
vote
2answers
59 views

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and ...
8
votes
1answer
633 views

Can hand/finger movements be determined via changes in WiFi signal strength?

On a password generator website I came across the following claim among a list of security tips: If there are WIFI routers in your home, then it's possible to know the passwords you typed (in your ...
0
votes
0answers
182 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
2
votes
1answer
142 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
2
votes
1answer
725 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
1answer
96 views

Recent attacks and vulnerabilities [closed]

How can I be up to date and get news on recent attacks and vulnerabilities? Is there any trusted source of information (websites, databases, ...)
2
votes
1answer
77 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
1answer
215 views

Do vendors put backdoors on network devices?

There are several articles that says that vendors plant backdoors on network devices intentionally, such as this one. They found backdoors that were made by the vendors. Also, I read somewhere else ...
63
votes
2answers
11k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
0
votes
3answers
248 views

Is It More Secure to Use Firewalls from Two Different Vendors?

The topic is "Is It More Secure to Use Firewalls from Two Different Vendors " Is not much safer using a multi-vendor firewall because "More than 95% of firewall breaches are caused by firewall ...
1
vote
1answer
171 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
1answer
84 views

Is it possible to get data from database server if you are on the application server?

For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
3
votes
2answers
222 views

How do hackers find vulnerabilities in closed source operating systems?

I'm not planning on hacking anything, but I'm just wondering how hackers find vulnerabilities in closed source operating systems such as Windows, since they don't know exactly what the code is doing? ...
1
vote
1answer
182 views

What are good, safe, not necessarily anonymous ways to disclose vulnerabilities?

Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be ...
0
votes
0answers
103 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
0
votes
1answer
90 views

Server vulnerability scanning [closed]

How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security. Thanks in advance
63
votes
1answer
6k views

Who “brands” vulnerabilities?

It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who ...
2
votes
0answers
94 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
0
votes
1answer
193 views

The older the Linux kernel is, the more secure?

Are there security benefits running Linux Distro base on an older version of Linux kernel? Security benefits = fewer vulnerabilities that can be exploited by hackers. Linux Distro base on older ...
1
vote
1answer
80 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
3answers
266 views

Is it possible to hack into secured wifi and download with bit torrent from my IP address?

Is it possible to hack into secured wifi and download using BitTorrent from my IP address? I live in Denmark- if that makes any difference. We changed to a new WIFI service provider a few years back (...
0
votes
0answers
63 views

Why 6.7 version of image magick can be exploitable even it is Vulnerable version?

I have installed a vulnerable version of the image magick i.e. 6.7 and according to this CVE-2016–3714 it is a vulnerable version. Now why I downloaded it because to get a clear picture of this ...
2
votes
1answer
327 views

What is NetSpectre?

A new attack was revealed in a document titled NetSpectre: Read Arbitrary Memory over Network (PDF warning). I've seen a few non-technical writeups about the fact that it's a pretty slow attack: ...
4
votes
2answers
180 views

Security of WWAN cards in laptops

I'm thinking about buying a WWAN card for my laptop (like this one here), as it is more convenient to use than USB tethering. However, I'm concerned about the security risk that comes with such a card ...
3
votes
1answer
318 views

strstr and fopen, is there a bypass?

I have a binary that does this: if (strstr(USERCONTROLLERSTRING, "..")) exit; fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r"); then spits out all the content of the file. Is there any ...
13
votes
6answers
8k views

What pages are vulnerable to SQL injection?

I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
3
votes
1answer
103 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
-1
votes
2answers
97 views

Extracting passwords from recycled machine using Spectre and Meltdown

With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
1
vote
1answer
42 views

Incomplete Data In Format String Dump

I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results. I made a sample program which has a ...
-2
votes
1answer
272 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
1
vote
1answer
217 views

Are the details about the Widevine bug now public?

There was a bug in Widevine last year which enabled downloading Encrypted Media Extension Content. They stated that they would give full details after 90 days. Was this meant for public disclosure or ...
-1
votes
1answer
248 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
1
vote
0answers
103 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
2answers
549 views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
1
vote
1answer
130 views

Could you use svchost to run any service?

Is it possible if per say you installed an "evil_service," to use svchost to run it? Will it run any service?
2
votes
1answer
112 views

How can an old hardware lead to a security failure?

I am working on critical cyber physical systems, and my work and research lead me to some questions. In the following, I assume that the attacker is not able to change the hardware of your system and ...
1
vote
0answers
64 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
3
votes
0answers
185 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
0
votes
1answer
514 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
3
votes
1answer
291 views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
5
votes
3answers
2k views

Is the Linux kernel vulnerable to LazyFP (CVE-2018-3665)?

Recently, a side-channel attack was discovered that exploits lazy FPU state switching to leak the contents of MMX, SSE, and AVX registers. The vulnerability can only be exploited when lazy FPU saves ...
1
vote
0answers
39 views

A database query error in Wikimedia 1.27.4

I have a website running Wikimedia 1.27.4 , When I insert (--) symbol in search box I get this error message A database query error has occurred. This may indicate a bug in the software. I got some ...
4
votes
1answer
256 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
2
votes
0answers
80 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
4
votes
1answer
72 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
3
votes
2answers
210 views

What is the attack surface on a L2 switch?

I'm trying to figure out what makes a "top brand" switch better than a "cheap unknown brand" one with the same features. I often see security thrown in the mix, but really can't understand how this ...