Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
2
votes
1answer
121 views

How long to wait before publishing a web vulnerability?

I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several ...
2
votes
1answer
208 views

envelope encryption (using KMS) vs ECDH

at work I have implemented basic envelope encryption when sending messages to a client. I am using AWS KMS and have a master key there. I get a data key, encrypt the message with AES-GCM and send the ...
0
votes
2answers
190 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
13
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
2
votes
0answers
329 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
2
votes
1answer
56 views

Given a list of components and versions, how can I check if any of them have known vulnerabilities?

In this case, I have a list of names and versions, but not access to any source code or binaries. E.g. ComponentA 2.6.6 ComponentB 1.1 ComponentC 0.12 The list is more than 300 components long, so ...
0
votes
2answers
232 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
0
votes
1answer
326 views

Reverse Shell Exploit for SquirrelMail 1.4.22 [closed]

I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is ...
0
votes
1answer
213 views

What famous attacks used a use-after-free vulnerability?

I'm compiling vulnerabilities and related attacks, and I need to find a famous attack that exploited a use-after-free vulnerability. I've looked for a while though I can't seem to find any. I know ...
1
vote
1answer
561 views

Default or Guessable SNMP community names: public

We have detected "Default or Guessable SNMP community names: public" vulnerability in one of our printer through Nexpose. The remediation states we have to secure SNMP installation. What does it mean ...
0
votes
1answer
111 views

Could an Smart TV be a threat for a hotel?

After some research I found that a Smart TV which is connected on the Internet could be vulnerable to threats such as monitoring, taking control of the tv etc. I wonder if a Smart TV which is used by ...
1
vote
2answers
276 views

How to search for all computers running memcached on shodan

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port ...
1
vote
2answers
78 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
2answers
213 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
3
votes
1answer
942 views

How did a bug like CVE-2018-10933 (libssh authentication bypass) happen?

How did a bug like the recent libssh vulnerability come to exist? Exactly what is the nature and root cause of the bug? From libssh's website: libssh versions 0.6 and above have an authentication ...
70
votes
3answers
32k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
2
votes
1answer
578 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
1
vote
1answer
67 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
1answer
487 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
0
votes
0answers
147 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
2
votes
3answers
166 views

Do WordPress vulnerabilities matter in intranet?

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only ...
0
votes
1answer
93 views

How secure is a serial/terminal/console server, from the serial side?

I'm upgrading my home lab, and one of the things I'm planning on introducing this time is out-of-band management through a Raspberry Pi console server similar to this: https://www.packet6.com/...
1
vote
2answers
133 views

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and ...
8
votes
1answer
692 views

Can hand/finger movements be determined via changes in WiFi signal strength?

On a password generator website I came across the following claim among a list of security tips: If there are WIFI routers in your home, then it's possible to know the passwords you typed (in your ...
0
votes
0answers
414 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
2
votes
1answer
291 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
3
votes
1answer
1k views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
1answer
114 views

Recent attacks and vulnerabilities [closed]

How can I be up to date and get news on recent attacks and vulnerabilities? Is there any trusted source of information (websites, databases, ...)
2
votes
1answer
150 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
1answer
313 views

Do vendors put backdoors on network devices?

There are several articles that says that vendors plant backdoors on network devices intentionally, such as this one. They found backdoors that were made by the vendors. Also, I read somewhere else ...
63
votes
2answers
11k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
0
votes
3answers
483 views

Is It More Secure to Use Firewalls from Two Different Vendors?

The topic is "Is It More Secure to Use Firewalls from Two Different Vendors " Is not much safer using a multi-vendor firewall because "More than 95% of firewall breaches are caused by firewall ...
1
vote
1answer
183 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
1answer
93 views

Is it possible to get data from database server if you are on the application server?

For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary ...
3
votes
2answers
734 views

How do hackers find vulnerabilities in closed source operating systems?

I'm not planning on hacking anything, but I'm just wondering how hackers find vulnerabilities in closed source operating systems such as Windows, since they don't know exactly what the code is doing? ...
1
vote
1answer
250 views

What are good, safe, not necessarily anonymous ways to disclose vulnerabilities?

Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be ...
0
votes
0answers
112 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
0
votes
1answer
99 views

Server vulnerability scanning [closed]

How can I discover server vulnerabilities without using a scanning software such as openVas? is there any manual ways or steps to follow to assure server security. Thanks in advance
63
votes
1answer
6k views

Who “brands” vulnerabilities?

It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who ...
2
votes
0answers
124 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
0
votes
1answer
386 views

The older the Linux kernel is, the more secure?

Are there security benefits running Linux Distro base on an older version of Linux kernel? Security benefits = fewer vulnerabilities that can be exploited by hackers. Linux Distro base on older ...
1
vote
1answer
153 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
3answers
528 views

Is it possible to hack into secured wifi and download with bit torrent from my IP address?

Is it possible to hack into secured wifi and download using BitTorrent from my IP address? I live in Denmark- if that makes any difference. We changed to a new WIFI service provider a few years back (...
2
votes
1answer
352 views

What is NetSpectre?

A new attack was revealed in a document titled NetSpectre: Read Arbitrary Memory over Network (PDF warning). I've seen a few non-technical writeups about the fact that it's a pretty slow attack: ...
4
votes
2answers
277 views

Security of WWAN cards in laptops

I'm thinking about buying a WWAN card for my laptop (like this one here), as it is more convenient to use than USB tethering. However, I'm concerned about the security risk that comes with such a card ...
3
votes
1answer
525 views

strstr and fopen, is there a bypass?

I have a binary that does this: if (strstr(USERCONTROLLERSTRING, "..")) exit; fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r"); then spits out all the content of the file. Is there any ...
13
votes
6answers
8k views

What pages are vulnerable to SQL injection?

I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
3
votes
1answer
144 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
-1
votes
2answers
103 views

Extracting passwords from recycled machine using Spectre and Meltdown

With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
1
vote
1answer
73 views

Incomplete Data In Format String Dump

I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results. I made a sample program which has a ...