Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

1
vote
2answers
117 views

How bad is to render html from cookies?

Recently I worked with a PHP framework and saw that it was putting html in a cookie to read it from javascript (don't ask me why). I tried to alter the html in the cookie by putting an alert('bingo') ...
1
vote
0answers
65 views

IBM Appscan vs Flaw finder

What is the main difference between an open source tool like flaw finder and a costly commercial tool like IBM Appscan. One is reporting that we get a presentable report with commericial tools but is ...
0
votes
1answer
226 views

Is an exploit that exposes the balance of any account in the bank a high risk exploit?

I have found an exploit to get account balance information for any account in my bank website. What is the level of this exploit (risk, medium, low)? and is it ethical to ask for a prize or money ...
0
votes
1answer
68 views

Are CVE identifiers assigned for proprietary software packages? [duplicate]

If I find a vulnerability while using a proprietary software package can I request a CVE identifier. Or rather vulnerabilities in proprietary software packages are a matter of me reporting issue to ...
6
votes
1answer
777 views

Is Intel i3 CPU affected by the Intel ME vulnerability?

Hello I have an Intel® Core™ i3-2328M CPU @ 2.20GHz computer processor (I think Sandy Bridge). https://ark.intel.com/products/70927/Intel-Core-i3-2328M-Processor-3M-Cache-2_20-GHz I have heard about ...
0
votes
1answer
637 views

Security risks with handling ZIP archives in web applications

I'm researching possible security risks when handling ZIP files, or archives in general, in web applications. The scenario is the following. The user is able to upload any ZIP (or in general an ...
5
votes
2answers
974 views

Just how much of a risk am I putting on my network by allowing UPnP

I am facing a serious conundrum (to me at least). Whether or not to disable UPnP on my network. I understand the risk, an infected computer could punch a hole in my firewall, and more infections can ...
5
votes
2answers
250 views

Why are the CVSS scores differ so much between Redhat and NVD page?

take CVE-2016-7872 for example. in National Vulnerability Database webpage, we can see that the cvss2 and cvss3 score are 9.8 and 10.0 respectively. but in the redhat security advisory page, they ...
1
vote
1answer
312 views

LFI code execution when directory specified

I am working on hackme, which introduce LFI in php code. <?php if (isset($_COOKIE["user"])) { $file="txt/".$_COOKIE["user"]; include $file; } ?> So I can include any file from the ...
0
votes
1answer
676 views

How to do RSA same message attack?

I found that I can attack texts that crypted by RSA with different public key, and same plain text. But I can't find how to decrypt them. I have three numbers(plain numbers are same): N=...
0
votes
1answer
138 views

Is Hamachi on a Linux production server a big system vulnerability?

The production server I am administrating can only be accessed through the company-network. However, if I have to do maintenance while not in the office, I can't access the server. Could I let ...
2
votes
1answer
2k views

Using data URIs to perform XSS in anchor tags - vulnerability? [duplicate]

I've been looking at a few issues related to XSS. In doing so, I've stumbled upon a few "XSS Filter Evasion" type checklists that demonstrate supposed XSS via data URIs. For example: The last line of:...
0
votes
1answer
88 views

Is the RHEL 7 version of FreeRadius not affected by RHSA-2017:1759 (or similar)?

In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no ...
0
votes
1answer
2k views

What is the proper server-side mitigation for the Lucky13 vulnerability (CVE-2013-0169) on a Windows server?

The testssl.sh tool stated that a server I tested is vulnerable to the Lucky13 (CVE-2013-0169) vulnerability. Below the testssl.sh output: ########################################################### ...
0
votes
1answer
464 views

What exploits are possible in languages like C/C++ other than overflow errors? [closed]

I know that C/C++ programs are highly susceptible to overflow errors that lead to program compromise. But I was wondering, are there any other vulnerabilites that can exist other than overflow errors? ...
0
votes
1answer
322 views

How to preform black-box (no source) vulnerability testing/fuzzing?

How would I (or) what software would I use to conduct local application (stored on the PC) black-box (no source/closed source) fuzzing or vulnerability testing for Windows? I've just been using common ...
5
votes
1answer
399 views

What are some options for a small company on a budget to maintain a bug bounty program? [closed]

I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers). Common advice that I've seen ...
0
votes
0answers
96 views

Are Metasploit built-in exploits used in real-life pen testing? [duplicate]

I just started seriously playing around with Metasploit, and a question kept coming into my mind. In the case of Adobe Flash for example, there are thousands of Flash vulnerabilities in CVEdetails....
1
vote
2answers
494 views

Java Deserialization issue

I have been reading about the Java deserialization vulnerability which leads to Remote Code Execution attack. Many public exploits are even available to do the attack. I didn't find any tutorial ...
1
vote
3answers
2k views

What is the difference between patch management and vulnerability management?

I've been thinking about this lately. are they the same thing? or is the latter has a lot more than just management of patches?
0
votes
1answer
138 views

How should potential (unverified) security vulnerabilities be best reported?

As an IT auditor, part of my job duties includes vendor risk assessment / conducting security due diligence. Based on documentation obtained from the vendor, (SOC 2 report, SIG survey ) , I and ...
0
votes
0answers
58 views

How user can change the tty information (related to CVE-2017-1000367)

Recently Red Hat fixed an important vulnerability in sudo: https://access.redhat.com/security/cve/cve-2017-1000367 From the description: A flaw was found in the way sudo parsed tty information ...
1
vote
0answers
152 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
4
votes
1answer
986 views

Function of %5c.. in a path traversal

I've recently come across this blog post of a bug bounty hunter. Apparently, a path traversal vulnerability was discovered, which looked like this: http://help.example.com/@app/skin/views/%5c../%5c....
2
votes
1answer
200 views

Is it enough for the server to require TLS 1.1?

If we want to ensure that connections use TLS version 1.1 or greater, is it sufficient to set one side of the connection to require TLS version 1.1 or greater or do both sides of the connection need ...
1
vote
0answers
88 views

Is user listing considered a vulnerability? [duplicate]

I couldn't find any other post on stack exchange talking about this. I have found a way to get a website to list all users and their names. Is this considered a vulnerability? This website does have ...
1
vote
1answer
320 views

What are the risks associated with a vulnerable javascript in a client context?

Background: it is not difficult to introduce vulnerabilities in backend/API code when not coding with security in mind. This typically leads to vulnerabilities such as XSS or various injections (or ...
1
vote
1answer
328 views

DLL hijacking - How to find out if path is relative

I am playing around with dll-hijacking and was wondering about something that I haven't been able to find out myself by googling. I get how the basics work with the fact that DLL's are loaded by an ...
3
votes
2answers
1k views

Are anti-cheat software (VAC, EasyAntiCheat, BattlEye, etc.) considered as potential threats?

Anti-cheat softwares are often flagged by antivirus as malware before they’re manually added to the whitelist, under the assumption that the people behind the anti-cheat act in good intention, and ...
0
votes
0answers
73 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
-1
votes
1answer
146 views

sql injection attack or vulnerability? Where can i find list of web application vulnerabilities and attack types ? [closed]

I can't separate OWASP Top-10 security risks, Sql Injection is attack or vulnerability ? If Sql injection is web application attack type(and other owasp security risks), then where can i find ...
4
votes
1answer
203 views

What makes me vulnerable to CVE-2017-7494?

I do understand that basically all Versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability. And there is even PoC Code to check if a specific server is vulnerable ...
0
votes
2answers
306 views

Is there any way to force browse HTTP if all the traffic is redirected to HTTPS? [closed]

The webserver is configured to redirect all HTTP request traffic to HTTPS. And there seems to be different application running on 80 and 443. 443 is not vulnerable but there are lot of vulnerability ...
4
votes
2answers
258 views

What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]

Does anybody discovered a zero day vulnerability? I know some black hat hackers sell that kind of info on deep web. But if you are a white hat... Which steps to perform? How to assure a CVE is ...
0
votes
2answers
2k views

some vulnerable projects in C or C++ for a lecture

I'm looking for some real projects which have stack overflow vulnerabilities. The important thing is, I am going to teach finding the vulnerabilities and the way of fixing them by these examples. So, ...
26
votes
7answers
5k views

Is the unauthorized deletion of data considered a breach of integrity or availability?

I am in the process of writing a security vulnerabilities report on an application used at my employer, having completed an application audit. One discovered vulnerability can lead to unauthorized ...
0
votes
1answer
434 views

Security in handling of user data by mSecure

mSecure is a password manager and the company has recently released their latest version (v5) that uses their own servers to store and sync user data. Some people are concerned about how they are ...
1
vote
1answer
92 views

About slowloris dos attack in skype

So I scanned my home pc for fun with nmap "vuln" script and it said something about the slowloris vulerability at port 443 . So I started up slowloris.pl and it really worked . After that I wondered ...
-10
votes
2answers
364 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
4
votes
1answer
348 views

Windows 7 and missing patches and how to handle

With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch. They had no patches after June 2016, with only the recent May 2017 patches installed. ...
1
vote
3answers
5k views

How can I tell if Windows is running SMB?

Due the vulnerability in Windows SMB Server (MS17-010), how can I tell if it is running? I am using Windows XP. None of the services I have running has the word "SMB" in the title or description. ...
1
vote
0answers
51 views

Do Intel Atom CPUs have ME / AMT? [duplicate]

I cannot find much clear documentation about that, especially when it specifically comes to ME. Regarding AMT, as I understood it requires vPro and Atoms (at least usually) don't come with it. So is ...
1
vote
1answer
72 views

How can websites with URL traversal functionality protect itself from revealing its IP?

A good number of websites these days are not served directly over the internet, but through an intermediate providers, such as Cloudflare and Incapsula. A basic premise of the security provided by ...
1
vote
0answers
56 views

Magento site hacked by unknown vulnerability [duplicate]

Home page of my Magento site is hacked. A hacker put his javascript and html code in design/head/includes of table core_config_data. Somehow he updated value of design/head/includes from NULL to his ...
7
votes
2answers
503 views

Intel AMT vulnerability - How is it a local threat?

INTEL-SA-00075 describes a vulnerability in the Intel AMT/ISM/SBT firmware. From Intels own bulletin this is a threat both locally and remotely. How is a threat in the local scenario? I understand ...
1
vote
1answer
420 views

Windows Applications for Exploit Development exercising? [closed]

I started to learn ASM and learned a lot about exploit development in the last few weeks. My question is, are there any comparable vulnerable windows programs like vulnserver out there which are good ...
4
votes
1answer
501 views

Special characters in filename leads to starting virus executable [duplicate]

So I've just downloaded torrent with one file in it - the formal name of file should be "123.avi.exe" (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in ...
2
votes
1answer
445 views

REST API and security

In a few occasions, pen-testers asked me to avoid the use of detailed HTTP return codes that could reveal information to an attacker. For example, they said that it is wrong to return a 404 when the ...
5
votes
0answers
57 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
8
votes
2answers
5k views

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

I read about the security vulnerability that Intel explains here On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name. Their guide on ...