Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
-2
votes
1answer
357 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
1
vote
1answer
297 views

Are the details about the Widevine bug now public?

There was a bug in Widevine last year which enabled downloading Encrypted Media Extension Content. They stated that they would give full details after 90 days. Was this meant for public disclosure or ...
-1
votes
1answer
294 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
1
vote
0answers
142 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
2answers
913 views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
1
vote
1answer
354 views

Could you use svchost to run any service?

Is it possible if per say you installed an "evil_service," to use svchost to run it? Will it run any service?
2
votes
1answer
115 views

How can an old hardware lead to a security failure?

I am working on critical cyber physical systems, and my work and research lead me to some questions. In the following, I assume that the attacker is not able to change the hardware of your system and ...
1
vote
0answers
103 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
3
votes
0answers
189 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
1
vote
1answer
714 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
5
votes
1answer
660 views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
5
votes
3answers
2k views

Is the Linux kernel vulnerable to LazyFP (CVE-2018-3665)?

Recently, a side-channel attack was discovered that exploits lazy FPU state switching to leak the contents of MMX, SSE, and AVX registers. The vulnerability can only be exploited when lazy FPU saves ...
1
vote
0answers
46 views

A database query error in Wikimedia 1.27.4

I have a website running Wikimedia 1.27.4 , When I insert (--) symbol in search box I get this error message A database query error has occurred. This may indicate a bug in the software. I got some ...
4
votes
1answer
385 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
2
votes
0answers
80 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
4
votes
1answer
79 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
3
votes
2answers
336 views

What is the attack surface on a L2 switch?

I'm trying to figure out what makes a "top brand" switch better than a "cheap unknown brand" one with the same features. I often see security thrown in the mix, but really can't understand how this ...
2
votes
0answers
229 views

How does biometric authentication work from a technical perspective?

Together with a colleague, we discussed the way of biometric authentication and how this works out. Both of us are only interested in security but far from being an expert on the technical side. ...
1
vote
1answer
1k views

How to prevent persistent XSS vulnerability with the Java Struts 1 Framework?

I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting). What kind of XSS ...
1
vote
1answer
1k views

Dealing with NULL byte (0x00) in offsets

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the ...
0
votes
2answers
669 views

Source Code analysis tools available? [closed]

In the near future I have to check the source code of a web application on security vulnerabilities. The web application mainly consists of PHP files and contains more than 300 files. Do you know ...
5
votes
1answer
76 views

What are the EFAIL “backchannels in email clients not related to HTML”?

The published examples for exploiting the EFAIL email encryption vulnerability all appear to use HTML to create a backchannel for exfiltrating decrypted data. However, the homepage of EFAIL, https://...
0
votes
1answer
284 views

What is the attack vector for CVE-2018-3639 Speculative Store Bypass?

We use Web Application deployed on a CentOS server. Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server? I cannot understand the attack vector ...
7
votes
1answer
192 views

How to be taken seriously when doing responsible disclosure?

Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input ...
9
votes
5answers
819 views

How to find out what vulnerabilities X product has had/has?

Canonical question regarding the best way of obtaining information on what vulnerabilities X product has had/has. Other identical or significantly similar questions should be closed as a duplicate of ...
6
votes
1answer
103 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
11
votes
3answers
806 views

How can malware immediately infect a Windows XP computer as soon as it goes online without any user action?

This is a thing I used to hear back in the olden days of Windows XP... People were telling me that a computer running on an out-of-date Windows XP system with no antivirus software was getting ...
1
vote
1answer
269 views

What approaches are used to discover zero-day vulnerabilities?

As a developer of multiple standalone apps (Web-/Native apps) I am wondering, what things I should keep in mind / what are typical approaches of a blackhat (besides of these scriptkiddies checking for ...
1
vote
0answers
756 views

How did I got hacked? [closed]

What happened: Event 1 A few months ago I was working on my laptop (laptop1). During my activities, sometimes I saw a text selection, when moving my mouse. I thought this happend due to a bad key. ...
1
vote
1answer
110 views

Why is CVE-2017-5461 rated Critical with CVSS Score 9.8?

A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for those who is not very ...
0
votes
1answer
68 views

If the browser enforces a Sandox, then why the infections by malware?

By design the browser enforces a Sandbox, but we know that Javascript which runs inside this sandbox can be used to do malware damage etc.Isn't the sandbox supposed to protect against it as well as ...
1
vote
1answer
3k views

OpenVas gets stuck on some scans

We have been using OpenVas to scan our servers for months now. Recently the scans are getting stuck on different %, always below 30%. We did not change anything in my local configuration. I read a ...
0
votes
1answer
399 views

Does WD My Passport WDBYFT0040BBK-WESN have encryption vulnerability?

Recently I came across this whitepaper: https://eprint.iacr.org/2015/1002.pdf It states vulnerabilities in Western Digital hard drives but doesn't include exact model numbers. I have WD My Passport ...
3
votes
2answers
642 views

How exactly does the NVIDIA Tegra Fusée Gelée exploit work?

Just yesterday a vulnerability--Fusée Gelée--was found in the Nintendo Switch NVIDIA Tegra chips that will purportedly allow linux to be loaded onto the devices, among other things. However, even on ...
2
votes
0answers
91 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
1
vote
2answers
168 views

Identify a security risk in a car-sharing system

A car sharing company provides a fleet of 20 vehicles, with the following features: Each user of the sharing scheme has an individual smart-card enabling them to open the car, as long as they have ...
0
votes
1answer
630 views

SSL cookie without secure flag set situation for “Authorization: Bearer”

I am currently reviewing an web application which dose use Cookies (non authentication related) without secure flag set but uses an "background" API to retrieve authenticated data using Authorization: ...
0
votes
1answer
134 views

Windows Server more vulnerable for password extraction during shutdown?

Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional ...
0
votes
1answer
4k views

How to fix Path Disclosure Vulnerability?

I have run a Qualys Web Application Scan for a customer website and found the "Path Disclosure Path-Based Vulnerability". If the normal URL is like this http://example.com/ When I go to the URL http:/...
-1
votes
1answer
471 views

Is an undefined index PHP error a vulnerability?

I found a website with the error below: Notice: Undefined index: welcome in /var/www/html/blah/index.php on line 14 Is that a vulnerability?
1
vote
2answers
67 views

Does installing more programs result in higher chances of being exploited?

Theoretically, the answer could be yes since you increase the attack surface. However, I was wondering if in practice it really makes a difference. I am mostly worried about exploits for web facing ...
1
vote
1answer
319 views

Install Metasploitable on PC [closed]

I am a teacher giving pentesting classes and I have a group of students that I have been teaching for 4 years now. I would like to make a little "hacking contest" in which there is a vulnerable ...
1
vote
1answer
282 views

How to avoid response manipulation in NodeJS Application?

I have a NodeJS application on the server. The attacker from the client system already knows how the success response looks like for a request. Next time he sends a request with wrong credentials, ...
-6
votes
1answer
102 views

How do hackers compromise the defence network of a country? [closed]

Theoretically speaking, what is the process involved in hacking into a country's defence network? How does the hacker connect to the network in the first place? Are special methods of hacking used in ...
2
votes
0answers
331 views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
1
vote
2answers
188 views

What is the significance of Spectre and Meltdown?

Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much. These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
0
votes
3answers
392 views

How do headphones work? Do they contain firmware? [closed]

How do headphones work? Do they contain any firmware or any instruction set? Are they vulnerable to anything? Good old wired analog Jack ones, not USB wired, wireless, Bluetooth which have lot of ...
8
votes
2answers
288 views

How to report a security vulnerability involving multiple unrelated companies?

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products. All those issues aren't security ...
2
votes
1answer
99 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
1
vote
2answers
140 views

Severity and priority rank of Insecure Direct Object Reference bug

Recently, I found bug in an e-commerce web app and I will report it. The bug I found can: delete and edit the favorite products list for all users delete all notifications for all users What ...