Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

1
vote
1answer
520 views

How to prevent persistent XSS vulnerability with the Java Struts 1 Framework?

I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting). What kind of XSS ...
1
vote
1answer
672 views

Dealing with NULL byte (0x00) in offsets

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the ...
0
votes
2answers
368 views

Source Code analysis tools available? [closed]

In the near future I have to check the source code of a web application on security vulnerabilities. The web application mainly consists of PHP files and contains more than 300 files. Do you know ...
5
votes
1answer
66 views

What are the EFAIL “backchannels in email clients not related to HTML”?

The published examples for exploiting the EFAIL email encryption vulnerability all appear to use HTML to create a backchannel for exfiltrating decrypted data. However, the homepage of EFAIL, https://...
0
votes
1answer
214 views

What is the attack vector for CVE-2018-3639 Speculative Store Bypass?

We use Web Application deployed on a CentOS server. Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server? I cannot understand the attack vector ...
0
votes
0answers
53 views

Is it inherently insecure to fetch HTML and JS content from server and attach it to an existing HTML node (while executing all scripts)?

Two ways to develop a web app: Either the "classical" way, completely reloading the page with each request, or the "API" way, that is make the server only send JSON data and make the client fetch it ...
7
votes
1answer
158 views

How to be taken seriously when doing responsible disclosure?

Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input ...
9
votes
5answers
584 views

How to find out what vulnerabilities X product has had/has?

Canonical question regarding the best way of obtaining information on what vulnerabilities X product has had/has. Other identical or significantly similar questions should be closed as a duplicate of ...
6
votes
1answer
98 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
11
votes
3answers
633 views

How can malware immediately infect a Windows XP computer as soon as it goes online without any user action?

This is a thing I used to hear back in the olden days of Windows XP... People were telling me that a computer running on an out-of-date Windows XP system with no antivirus software was getting ...
0
votes
1answer
175 views

Vulnerability Analysis

As a developer of multiple standalone apps (Web-/Native apps) I am wondering, what things I should keep in mind / what are typical approaches of a blackhat (besides of these scriptkiddies checking for ...
1
vote
0answers
424 views

How did I got hacked? [closed]

What happened: Event 1 A few months ago I was working on my laptop (laptop1). During my activities, sometimes I saw a text selection, when moving my mouse. I thought this happend due to a bad key. ...
1
vote
1answer
99 views

Why is CVE-2017-5461 rated Critical with CVSS Score 9.8?

A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for those who is not very ...
0
votes
1answer
59 views

If the browser enforces a Sandox, then why the infections by malware?

By design the browser enforces a Sandbox, but we know that Javascript which runs inside this sandbox can be used to do malware damage etc.Isn't the sandbox supposed to protect against it as well as ...
0
votes
1answer
2k views

OpenVas gets stuck on some scans

We have been using OpenVas to scan our servers for months now. Recently the scans are getting stuck on different %, always below 30%. We did not change anything in my local configuration. I read a ...
0
votes
0answers
225 views

Drupal 6.x Vulnerablity

Is there is any Loophole in Drupal 6.x where the vulnerability leads to admin account access? I heard about "Drupalgeddon 2" this attack can exploit any version of Drupal 6.x, 7.x and 8.x but Drupal ...
0
votes
1answer
277 views

Does WD My Passport WDBYFT0040BBK-WESN have encryption vulnerability?

Recently I came across this whitepaper: https://eprint.iacr.org/2015/1002.pdf It states vulnerabilities in Western Digital hard drives but doesn't include exact model numbers. I have WD My Passport ...
3
votes
2answers
484 views

How exactly does the NVIDIA Tegra Fusée Gelée exploit work?

Just yesterday a vulnerability--Fusée Gelée--was found in the Nintendo Switch NVIDIA Tegra chips that will purportedly allow linux to be loaded onto the devices, among other things. However, even on ...
2
votes
0answers
85 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
1
vote
2answers
149 views

Identify a security risk in a car-sharing system

A car sharing company provides a fleet of 20 vehicles, with the following features: Each user of the sharing scheme has an individual smart-card enabling them to open the car, as long as they have ...
0
votes
1answer
333 views

SSL cookie without secure flag set situation for “Authorization: Bearer”

I am currently reviewing an web application which dose use Cookies (non authentication related) without secure flag set but uses an "background" API to retrieve authenticated data using Authorization: ...
0
votes
1answer
133 views

Windows Server more vulnerable for password extraction during shutdown?

Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional ...
0
votes
1answer
2k views

How to fix Path Disclosure Vulnerability?

I have run a Qualys Web Application Scan for a customer website and found the "Path Disclosure Path-Based Vulnerability". If the normal URL is like this http://example.com/ When I go to the URL http:/...
-1
votes
1answer
330 views

Is an undefined index PHP error a vulnerability?

I found a website with the error below: Notice: Undefined index: welcome in /var/www/html/blah/index.php on line 14 Is that a vulnerability?
0
votes
0answers
281 views

How to find the right exploit for a web application automatically in metasploit?

I am writing a tool in order to detect and exploit possible vulnerabilities in web apps or software automatically. Therefore, firstly my tool finds a possible vulnerable path and gives it to an ...
1
vote
2answers
65 views

Does installing more programs result in higher chances of being exploited?

Theoretically, the answer could be yes since you increase the attack surface. However, I was wondering if in practice it really makes a difference. I am mostly worried about exploits for web facing ...
1
vote
1answer
169 views

Install Metasploitable on PC [closed]

I am a teacher giving pentesting classes and I have a group of students that I have been teaching for 4 years now. I would like to make a little "hacking contest" in which there is a vulnerable ...
1
vote
1answer
201 views

How to avoid response manipulation in NodeJS Application?

I have a NodeJS application on the server. The attacker from the client system already knows how the success response looks like for a request. Next time he sends a request with wrong credentials, ...
-6
votes
1answer
97 views

How do hackers compromise the defence network of a country? [closed]

Theoretically speaking, what is the process involved in hacking into a country's defence network? How does the hacker connect to the network in the first place? Are special methods of hacking used in ...
2
votes
0answers
208 views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
1
vote
2answers
175 views

What is the significance of Spectre and Meltdown?

Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much. These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
0
votes
3answers
315 views

How do headphones work? Do they contain firmware? [closed]

How do headphones work? Do they contain any firmware or any instruction set? Are they vulnerable to anything? Good old wired analog Jack ones, not USB wired, wireless, Bluetooth which have lot of ...
8
votes
2answers
266 views

How to report a security vulnerability involving multiple unrelated companies?

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products. All those issues aren't security ...
2
votes
1answer
96 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
1
vote
2answers
126 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...
6
votes
1answer
218 views

Can an attacker force a browser to use quirks mode to render a page?

During a pentest, I've found a potential vulnerability on a web page, but it can only be exploited in quirks mode. The page starts with <!doctype html>, which triggers standards mode so at ...
1
vote
1answer
395 views

Root privilege using Return-to-libc attack

I've been working on Return-to-libc Attack Lab from SEED (Lab Description and Tasks). The environment is Ubuntu 12.04 32 bit. Please consider the following code: /* This program has a buffer overflow ...
1
vote
0answers
327 views

Side channel attack with flush+reload

I have been reading about cache side channel attacks and the "Flush+Reload" method came up a decent amount. Before putting forth my question, this is what I understand about the Flush+reload technique....
-3
votes
1answer
187 views

Why are mailboxes unsecure? [closed]

Why can anyone go up to a mailbox and just take the mail out of it? Some mailboxes, like at townhouses and apartments, have locks, but the mailboxes at single family homes that I have seen do not. Isn’...
0
votes
1answer
99 views

Security implications of storing encrypted snapshots on cloud

We have to deliver a zero-knowledge SQLite based accounting/reviewing app running on Mac 10.6 and above. We are asked to upload snapshots of database to cloud (AWS S3 or GCP) at regular intervals; so ...
2
votes
1answer
3k views

Is downloading Windows ISOs from TechBench downloaders safe?

How safe are TechBench downloaders? Is it safe to download an iso from TechBench downloading service for example: https://tb.rg-adguard.net/public.php I have no idea how it works but it supposedly ...
5
votes
3answers
139 views

Is the Cisco vulnerability specific to Cisco or is it something in some commonly used library?

I am referring to the vulnerability reported here: Cisco secuirty advisory on "Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability" CIS adviory on the same ...
1
vote
1answer
70 views

How do you change the password of an IoT device like a DVR box?

The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet. My ...
6
votes
1answer
357 views

External command execution in Excel formulas

It's known that MS Excel functionality of external references will allow executing arbitrary commands from its formulas with appropriate security warnings and confirmation required from the user. E.g....
8
votes
1answer
1k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
1
vote
1answer
160 views

How vulnerability scanners identify version of services on targets

I would like to know that how vulnerability scanners identify the version of services running on the target after identifying the service by the port number.
1
vote
1answer
69 views

Do vulnerability reports often get disregarded for lack of information?

I recently came across the following article. Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team. ...
3
votes
1answer
2k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
1
vote
1answer
161 views

Finding Security Loopholes and reporting ( web applications specifically)

The people who get a place in the hall of fame or get acknowledged specifically for attacks like XSS, rce and some common type of attacks which can be detected by scanning tools such as owasp, Nessus, ...
1
vote
1answer
159 views

How the attacking vector of Skygofree is composed?

Regarding recently emerging Skygofree trojan for mobile devices, having read the following article Secure list / Skygofree summary it is still unclear to me how the device is getting affected with ...