Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

-4
votes
3answers
276 views

Could programming languages be vulnerable? [closed]

For example, could PHP language be vulnerable hence millions of websites be vulnerable also just because they used it regardless of the written code?
2
votes
1answer
103 views

Are CVEs and EDBs normally hard to reproduce? [closed]

For a while I've played around with reproducing vulnerabilities reported in websites such as Exploit-DB (EDB) as a learning experience. However, I often find cases which I just can't get to work. In ...
2
votes
1answer
109 views

What defines a CSRF vulnerability?

As a part of my position at the company I am employed with, I manually penetration test our web application (still in development) for vulnerabilities. While testing, I attempted to see if our web ...
35
votes
6answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
2
votes
1answer
2k views

What makes servers vulnerable to Return Of Bleichenbacher's Oracle Threat (ROBOT) attack?

Is server vulnerable if it supports RSA key exchange ciphers? Can server be still vulnerable if it is running on unpatched vendor software but does not support RSA key exchange ciphers? After applying ...
4
votes
1answer
223 views

Are mitigations for Spectre and Meltdown needed in the VMs for dynamic languages other than JavaScript?

Mitigations for Spectre and Meltdown are being added to the JavaScript VMs in Chrome, Firefox, IE/Edge and WebKit. Are similar mitigations also needed in the VMs for other dynamic languages? For ...
5
votes
1answer
427 views

Why were Meltdown and Spectre disclosed at the same time?

Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9). Since their public reveal, there has been some confusion ...
1
vote
2answers
284 views

How can I change windows security settings using python? i.e. Password Requirements / Require Ctrl - Alt - Delete to log in

I am writing code in Python 2 or 3 to script Cybersecurity functions. Functions such as Lockout Duration, Password Length, and other things that involve a lot of clicking that could easily be ...
1
vote
0answers
53 views

Is my website being checked for vulnerabilities or being attacked? [duplicate]

I have a website running on windows hosting with plesk 11 version and website is based on .net 4.5 by default PHP is also active for this website but is not being used. I have disabled PHP as i am not ...
3
votes
1answer
224 views

Are Meltdown and Spectre complementary and used together

Meltdown and Spectre have both been announced at the same time, almost always in the same sentence. Is there a connection, other than timing and the fact that they attack chips? Are they used together ...
7
votes
2answers
1k views

Can Javascript engines that run on the JVM be used to implement the Spectre exploit?

I see that Chrome and Mozilla have added mitigations into their javascript engines for the Spectre vulnerabilities (CVE-2017-5753 & CVE-2017-5715). However I cant find anything regarding ...
166
votes
3answers
15k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
2
votes
2answers
654 views

Is there a microcode or other hardware fix for Meltdown?

Linked to my question here, the MS support page states In addition to installing the January security update, a processor microcode update is required. But previous articles I've read said ...
5
votes
2answers
968 views

Are VIA CPUs vulnerable to Spectre/Meltdown attacks?

I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs. Are they also affected by this vulnerabilities?
0
votes
1answer
182 views

Could you hack a gas station's fuel dispenser?

This might be a dumb question, but still, would it be possible for someone to hack in to a fuel dispenser and change the price, fuel consumed, etc?
4
votes
1answer
79 views

Potential risks of a single codebase for multiple CMSes

We are currently in the process of converting our multiple codebases (which are exactly the same, except for a configuration file and 2 stylesheets). We have been thinking about this for a while, and ...
3
votes
1answer
5k views

Is there a base version of jQuery which has no XSS vulnerability?

I am working on an enterprise project and we have a upcoming new release. The security team runs a security scan, in that vulnerability report there is one point that I am struggling with. The project ...
-4
votes
1answer
72 views

What kind of breaches a bitcoin website could have? [closed]

i want to develop a bitcoin website that allow users to deposit btc to their private address the website will generate , and i was told that i need an expert in information security in order to ...
0
votes
0answers
14 views

What are the ramifications of reporting a site vulnerablity? [duplicate]

I scanned a site the other day. I found a credit card number. How can I disclose this without anything going wrong for myself? Should I even disclose it?
105
votes
15answers
20k views

How can I argue against: “System is unhackable so why patch vulnerabilities?”

An operating system has reached End of Support (EoS) so no more security patches are coming for the OS ever. An embedded device running this OS needs to be updated to a newer version. However, the ...
14
votes
1answer
287 views

Why is caller ID spoofing so simple, and catching offenders so hard?

There is plenty of software which allows a user to input a recipient's information, and a fake-originator's information, and the software will complete the caller ID spoof. I'm trying to understand ...
32
votes
2answers
5k views

HTML login form without a CSRF protection

We've recently got a vulnerability report saying that one of our HTML forms in one of the internal applications is not CSRF protected. At first, we could not immediately reproduce it manually using ...
1
vote
0answers
28 views

What can one do to secure holes described by Arnaboldi? [closed]

I have just read: https://www.blackhat.com/docs/eu-17/materials/eu-17-Arnaboldi-Exposing-Hidden-Exploitable-Behaviors-In-Programming-Languages-Using-Differential-Fuzzing-wp.pdf Which describes some ...
1
vote
1answer
177 views

How to check if a third party jar(JRecord) has any security issues

We are in the process of using a third party jar which is not available in Maven Repo. It needs to be manually downloaded for usage. Is there any tool or way to find if the JAR has security issues? ...
1
vote
4answers
176 views

Aren't the current implementations for multi-factor authentication heavily dependent on a single point of failure?

A lot of 2-factor authentication methods seem to rely on either a text message, email or a one-time password like Google's Authenticator as the second step in authentication. It seems like these ...
4
votes
2answers
172 views

How to proceed with IoT Vulnerability assessment?

First: This is not one of those "How do I start hacking?" questions, but more of a "How do I begin testing a specific device?". It is a part of my Bachelor Thesis to perform a Vulnerability analysis/...
1
vote
0answers
278 views

SSL/TLS handshake potential vulnerabilities [duplicate]

After handshake one could be assure that data are encrypted and secure. But before that, handshake parameters are transferred via not secured channel. One could be MitM during the handshake procedure....
4
votes
1answer
1k views

What is the difference between local file inclusion (LFI) and remote file inclusion (RFI)?

Based on this previous question, it seems like the difference between directory traversal and file inclusion is as follows: Directory traversal Improper validation of user input leads to read ...
0
votes
1answer
652 views

How to scan PHP code for vulnerable functions? [closed]

I saw a pentest report and there was a section where the pentester list all the functions that are vulnerable in PHP. How did he scan the code and what tools can be used, and is it possible to do it ...
0
votes
1answer
43 views

Microsoft Office Memory Corruption Vulnerability Remote(CVE-2017-11884) or?

Is that CVE-2017-11884 is remote vulnerability which requires user interaction ? Can one execute it without luring the end user to run crafted file or something ? Well, I assumed that all remote ...
0
votes
2answers
169 views

The requirements of gathering information data without any limits? [closed]

It's a well known fact that phones, computers and other devices can be tracked and be used as a means of collecting user information if the situation permits it, for example in crime investigations. I ...
0
votes
1answer
174 views

Have the recent Linux kernel USB vulnerabilities found by Andrey Konovalov been patched?

Have the Linux USB drivers been patched for the recent vulnerabilities that have been found by Andrey Konovalov (Google)? If not what can be done to protect against these attacks other than avoiding ...
2
votes
2answers
2k views

Buffer Overflow doesn't have enough space for exploit after being crashed

So I'm trying to write a buffer overflow for a knowingly vulnerable server application, I want to learn how to do this on my own and just want some direction. I'm watching it in immunity debugger on ...
6
votes
1answer
277 views

What are the security measures taken on websites that allow online scripting such as jsfiddle and codepen?

As asked in the title, I have been wondering this for a while. These sites allow the user to write scripts and store them too. Are they not vulnerable to attacks such as cross-site scripting or any ...
1
vote
0answers
111 views

Quantifying security with metrics

I am working on a state-of-the-art quantification of security, meaning a numerical assessment of security for a system. In my research, most of the work is not recent (up to 2012 so far) and is ...
7
votes
1answer
1k views

Did iOS 11.1 fix KRACK for only iPhone 7 and newer?

This security article from Apple says that 11.1 fixes the KRACK vulnerability for iPhone 7 and newer devices. But what about the older devices? Has Apple not fixed them or does the vulnerability not ...
1
vote
2answers
264 views

Wordpress 4.7.6 vulnerabilities? [closed]

I have a wordpress 4.7.6 without plugins, however, I've noticed this: https://cxsecurity.com/cveshow/CVE-2017-14723 And the other vulnerabilities that are <4.8.2. My question is, I have tried to ...
3
votes
2answers
658 views

CVE submission process?

I have two questions regarding going through the process to requesting and getting a CVE ID for a vulnerability. Should I contact the Vendor first and wait to see if they acknowledge the ...
-1
votes
1answer
275 views

How does reducing the False Match Rate (FMR) in a biometric system can cause human factor vulnerabilities? [closed]

How is this vulnerability possible? How is FMR linked with human factor vulnerabiltiy? If there is a vulnerability what are ways to safeguard or mitigate such issues?
0
votes
3answers
90 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
0
votes
1answer
78 views

Building software safely for malware-free distribution

I wrote a program. I want to publish a compiled executable for downloading by the public. How can I compile and distribute it without contact with my (presumably insecure and infected) operating ...
0
votes
1answer
45 views

How do we exchange public key securely in a DV SSL connection? [closed]

Let's said we're running asymmetric encryption on a server with DV SSL encryption. With this condition set, how do we send the users' public key and private key generate in server to client in order ...
2
votes
1answer
332 views

Can the client communicate with the AP after a KRACK attack?

When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's a adversary in the ...
-2
votes
2answers
297 views

Is private key encryption to verify identity a weakness?

I'm trying to learn about cryptography and have discovered that you can use asymmetric key encryption to verify your identity by encrypting something with your private key, but isn't that a security ...
35
votes
1answer
4k views

How does a nonce reset allow for decryption?

I'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption ...
5
votes
3answers
492 views

Understanding the scope of Intel hyperthreading errata KBL095

Recently, many motherboards supporting skylake or kabylake, got a uefi update described as cpu microcode security update for a specific Intel errata, described by Intel as : Short Loops Which Use ...
-2
votes
1answer
120 views

How to know the vulnerabilities of my website? [closed]

My website had been hacked. Hackers were able to access my database and inject some script into my database, now although I have recovered my website but I want to protect my website from further ...
1
vote
1answer
50 views

Can CVSS score be different from that calculated from vector

In most databases, there two fields: CVSS vector and CVSS score. It's logical that if we calculate score from vector, it's supposed to be equal to the score field. But, can it be manually 'tuned' and ...
0
votes
1answer
523 views

Why am I able to bypass a website's authentication?

I am blackbox testing a vulnerable website. The website in question is accessed using HTTP and to reach its content one is prompted with a field to enter the password (presumably set by the admin) at ...
5
votes
2answers
3k views

What is BlueBorne and how to protect myself?

Since this is a hot-topic this week, I'm looking for a canonical answer: What is the BlueBorne Bluetooth vulnerability? How to protect myself?