Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

0
votes
1answer
2k views

OpenVas gets stuck on some scans

We have been using OpenVas to scan our servers for months now. Recently the scans are getting stuck on different %, always below 30%. We did not change anything in my local configuration. I read a ...
0
votes
1answer
320 views

Does WD My Passport WDBYFT0040BBK-WESN have encryption vulnerability?

Recently I came across this whitepaper: https://eprint.iacr.org/2015/1002.pdf It states vulnerabilities in Western Digital hard drives but doesn't include exact model numbers. I have WD My Passport ...
3
votes
2answers
523 views

How exactly does the NVIDIA Tegra Fusée Gelée exploit work?

Just yesterday a vulnerability--Fusée Gelée--was found in the Nintendo Switch NVIDIA Tegra chips that will purportedly allow linux to be loaded onto the devices, among other things. However, even on ...
2
votes
0answers
87 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
1
vote
2answers
154 views

Identify a security risk in a car-sharing system

A car sharing company provides a fleet of 20 vehicles, with the following features: Each user of the sharing scheme has an individual smart-card enabling them to open the car, as long as they have ...
0
votes
1answer
438 views

SSL cookie without secure flag set situation for “Authorization: Bearer”

I am currently reviewing an web application which dose use Cookies (non authentication related) without secure flag set but uses an "background" API to retrieve authenticated data using Authorization: ...
0
votes
1answer
134 views

Windows Server more vulnerable for password extraction during shutdown?

Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional ...
0
votes
1answer
3k views

How to fix Path Disclosure Vulnerability?

I have run a Qualys Web Application Scan for a customer website and found the "Path Disclosure Path-Based Vulnerability". If the normal URL is like this http://example.com/ When I go to the URL http:/...
-1
votes
1answer
400 views

Is an undefined index PHP error a vulnerability?

I found a website with the error below: Notice: Undefined index: welcome in /var/www/html/blah/index.php on line 14 Is that a vulnerability?
1
vote
2answers
65 views

Does installing more programs result in higher chances of being exploited?

Theoretically, the answer could be yes since you increase the attack surface. However, I was wondering if in practice it really makes a difference. I am mostly worried about exploits for web facing ...
1
vote
1answer
228 views

Install Metasploitable on PC [closed]

I am a teacher giving pentesting classes and I have a group of students that I have been teaching for 4 years now. I would like to make a little "hacking contest" in which there is a vulnerable ...
1
vote
1answer
230 views

How to avoid response manipulation in NodeJS Application?

I have a NodeJS application on the server. The attacker from the client system already knows how the success response looks like for a request. Next time he sends a request with wrong credentials, ...
-6
votes
1answer
100 views

How do hackers compromise the defence network of a country? [closed]

Theoretically speaking, what is the process involved in hacking into a country's defence network? How does the hacker connect to the network in the first place? Are special methods of hacking used in ...
2
votes
0answers
267 views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
1
vote
2answers
182 views

What is the significance of Spectre and Meltdown?

Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much. These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
0
votes
3answers
342 views

How do headphones work? Do they contain firmware? [closed]

How do headphones work? Do they contain any firmware or any instruction set? Are they vulnerable to anything? Good old wired analog Jack ones, not USB wired, wireless, Bluetooth which have lot of ...
8
votes
2answers
277 views

How to report a security vulnerability involving multiple unrelated companies?

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products. All those issues aren't security ...
2
votes
1answer
97 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
1
vote
2answers
134 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...
6
votes
1answer
227 views

Can an attacker force a browser to use quirks mode to render a page?

During a pentest, I've found a potential vulnerability on a web page, but it can only be exploited in quirks mode. The page starts with <!doctype html>, which triggers standards mode so at ...
1
vote
1answer
694 views

Root privilege using Return-to-libc attack

I've been working on Return-to-libc Attack Lab from SEED (Lab Description and Tasks). The environment is Ubuntu 12.04 32 bit. Please consider the following code: /* This program has a buffer overflow ...
1
vote
0answers
484 views

Side channel attack with flush+reload

I have been reading about cache side channel attacks and the "Flush+Reload" method came up a decent amount. Before putting forth my question, this is what I understand about the Flush+reload technique....
-3
votes
1answer
189 views

Why are mailboxes unsecure? [closed]

Why can anyone go up to a mailbox and just take the mail out of it? Some mailboxes, like at townhouses and apartments, have locks, but the mailboxes at single family homes that I have seen do not. Isn’...
0
votes
1answer
99 views

Security implications of storing encrypted snapshots on cloud

We have to deliver a zero-knowledge SQLite based accounting/reviewing app running on Mac 10.6 and above. We are asked to upload snapshots of database to cloud (AWS S3 or GCP) at regular intervals; so ...
2
votes
1answer
4k views

Is downloading Windows ISOs from TechBench downloaders safe?

How safe are TechBench downloaders? Is it safe to download an iso from TechBench downloading service for example: https://tb.rg-adguard.net/public.php I have no idea how it works but it supposedly ...
5
votes
3answers
141 views

Is the Cisco vulnerability specific to Cisco or is it something in some commonly used library?

I am referring to the vulnerability reported here: Cisco secuirty advisory on "Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability" CIS adviory on the same ...
1
vote
1answer
75 views

How do you change the password of an IoT device like a DVR box?

The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet. My ...
7
votes
1answer
411 views

External command execution in Excel formulas

It's known that MS Excel functionality of external references will allow executing arbitrary commands from its formulas with appropriate security warnings and confirmation required from the user. E.g....
8
votes
1answer
2k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
1
vote
1answer
190 views

How vulnerability scanners identify version of services on targets

I would like to know that how vulnerability scanners identify the version of services running on the target after identifying the service by the port number.
1
vote
1answer
72 views

Do vulnerability reports often get disregarded for lack of information?

I recently came across the following article. Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team. ...
3
votes
1answer
3k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
1
vote
1answer
173 views

Finding Security Loopholes and reporting ( web applications specifically)

The people who get a place in the hall of fame or get acknowledged specifically for attacks like XSS, rce and some common type of attacks which can be detected by scanning tools such as owasp, Nessus, ...
1
vote
1answer
173 views

How the attacking vector of Skygofree is composed?

Regarding recently emerging Skygofree trojan for mobile devices, having read the following article Secure list / Skygofree summary it is still unclear to me how the device is getting affected with ...
-4
votes
3answers
302 views

Could programming languages be vulnerable? [closed]

For example, could PHP language be vulnerable hence millions of websites be vulnerable also just because they used it regardless of the written code?
2
votes
1answer
114 views

Are CVEs and EDBs normally hard to reproduce? [closed]

For a while I've played around with reproducing vulnerabilities reported in websites such as Exploit-DB (EDB) as a learning experience. However, I often find cases which I just can't get to work. In ...
2
votes
1answer
112 views

What defines a CSRF vulnerability?

As a part of my position at the company I am employed with, I manually penetration test our web application (still in development) for vulnerabilities. While testing, I attempted to see if our web ...
35
votes
6answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
2
votes
1answer
2k views

What makes servers vulnerable to Return Of Bleichenbacher's Oracle Threat (ROBOT) attack?

Is server vulnerable if it supports RSA key exchange ciphers? Can server be still vulnerable if it is running on unpatched vendor software but does not support RSA key exchange ciphers? After applying ...
4
votes
1answer
233 views

Are mitigations for Spectre and Meltdown needed in the VMs for dynamic languages other than JavaScript?

Mitigations for Spectre and Meltdown are being added to the JavaScript VMs in Chrome, Firefox, IE/Edge and WebKit. Are similar mitigations also needed in the VMs for other dynamic languages? For ...
5
votes
1answer
429 views

Why were Meltdown and Spectre disclosed at the same time?

Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9). Since their public reveal, there has been some confusion ...
1
vote
2answers
307 views

How can I change windows security settings using python? i.e. Password Requirements / Require Ctrl - Alt - Delete to log in

I am writing code in Python 2 or 3 to script Cybersecurity functions. Functions such as Lockout Duration, Password Length, and other things that involve a lot of clicking that could easily be ...
1
vote
0answers
54 views

Is my website being checked for vulnerabilities or being attacked? [duplicate]

I have a website running on windows hosting with plesk 11 version and website is based on .net 4.5 by default PHP is also active for this website but is not being used. I have disabled PHP as i am not ...
3
votes
1answer
225 views

Are Meltdown and Spectre complementary and used together

Meltdown and Spectre have both been announced at the same time, almost always in the same sentence. Is there a connection, other than timing and the fact that they attack chips? Are they used together ...
7
votes
2answers
1k views

Can Javascript engines that run on the JVM be used to implement the Spectre exploit?

I see that Chrome and Mozilla have added mitigations into their javascript engines for the Spectre vulnerabilities (CVE-2017-5753 & CVE-2017-5715). However I cant find anything regarding ...
166
votes
3answers
15k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
2
votes
2answers
663 views

Is there a microcode or other hardware fix for Meltdown?

Linked to my question here, the MS support page states In addition to installing the January security update, a processor microcode update is required. But previous articles I've read said ...
5
votes
2answers
997 views

Are VIA CPUs vulnerable to Spectre/Meltdown attacks?

I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs. Are they also affected by this vulnerabilities?
0
votes
1answer
209 views

Could you hack a gas station's fuel dispenser?

This might be a dumb question, but still, would it be possible for someone to hack in to a fuel dispenser and change the price, fuel consumed, etc?
4
votes
1answer
79 views

Potential risks of a single codebase for multiple CMSes

We are currently in the process of converting our multiple codebases (which are exactly the same, except for a configuration file and 2 stylesheets). We have been thinking about this for a while, and ...