Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

5
votes
0answers
57 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
3
votes
0answers
185 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
2
votes
0answers
41 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
28 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
2
votes
0answers
172 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
2
votes
0answers
93 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
2
votes
0answers
80 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
2
votes
0answers
122 views

How does biometric authentication work from a technical perspective?

Together with a colleague, we discussed the way of biometric authentication and how this works out. Both of us are only interested in security but far from being an expert on the technical side. ...
2
votes
0answers
85 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
2
votes
0answers
208 views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
2
votes
0answers
219 views

Clarification on DH groups

Nikto reports the following via the "ssl-dh-params" NSE script: Check results: | WEAK DH GROUP 1 | Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | Modulus Type: Safe ...
2
votes
0answers
143 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
1
vote
0answers
16 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
1
vote
0answers
45 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
1
vote
0answers
102 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
0answers
61 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
1
vote
0answers
39 views

A database query error in Wikimedia 1.27.4

I have a website running Wikimedia 1.27.4 , When I insert (--) symbol in search box I get this error message A database query error has occurred. This may indicate a bug in the software. I got some ...
1
vote
0answers
327 views

Side channel attack with flush+reload

I have been reading about cache side channel attacks and the "Flush+Reload" method came up a decent amount. Before putting forth my question, this is what I understand about the Flush+reload technique....
1
vote
0answers
111 views

Quantifying security with metrics

I am working on a state-of-the-art quantification of security, meaning a numerical assessment of security for a system. In my research, most of the work is not recent (up to 2012 so far) and is ...
1
vote
0answers
65 views

IBM Appscan vs Flaw finder

What is the main difference between an open source tool like flaw finder and a costly commercial tool like IBM Appscan. One is reporting that we get a presentable report with commericial tools but is ...
1
vote
0answers
152 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
304 views

/var/www/cgi-bin/webcm vulnerability

I opened my apache error logs today and found this: [Fri Apr 28 06:52:59.219655 2017] [cgi:error] [pid 25030] [client 172.30.0.155:12810] script not found or unable to stat: /var/www/cgi-bin/webcm I ...
1
vote
0answers
21 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
1
vote
0answers
146 views

Exploitability of Heap Vulnerabilities

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list ...
1
vote
0answers
41 views

Protection against remote system compromise on binary code level

My (certainly incomplete) understanding of a remote system compromise on the binary code level is roughly: A program vulnerability, such as missing input validation, is exploited to insert external ...
1
vote
0answers
187 views

Countermeasure for privilege escalation for TeamPass

I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
1
vote
0answers
100 views

Finding Vuln in linux login console

I'm trying to find vulnerability on an appliance based on Ubuntu 12.0.4 and this is about console (COM port) section now. my findings: The password field is sensitive to large string. for example if ...
1
vote
0answers
142 views

Internet Explorer WScript Shell Enabled

While testing a company's systems security, I found out that they have allowed WScript.Shell to run in all of their Internet Explorer for Intranet websites. It works if you open HTML files in your IE ...
1
vote
0answers
176 views

How to craft Invalid packet to test for TLS Poodle vulnerability?

I need to test if a server is vulnerable to TLS Poodle. To do this I need to send an invalid packet to the server and check if it closes the connection. But I am not sure how I create that packet (...
1
vote
0answers
602 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
1
vote
0answers
166 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
1
vote
0answers
276 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
348 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] vulnerable ...
1
vote
0answers
148 views

Struts2 + action prefix vulnerability + CVE-2013-4310

CVE-2013-4310 indicates the action prefix (action:) feature of struts2 framework is vulnerable. Hence the vendor released the patch(?) by disabling this feature. However, there is an option to enable ...
0
votes
0answers
15 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
0
votes
0answers
62 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
0
votes
0answers
107 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
0answers
177 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
0
votes
0answers
63 views

Why 6.7 version of image magick can be exploitable even it is Vulnerable version?

I have installed a vulnerable version of the image magick i.e. 6.7 and according to this CVE-2016–3714 it is a vulnerable version. Now why I downloaded it because to get a clear picture of this ...
0
votes
0answers
53 views

Is it inherently insecure to fetch HTML and JS content from server and attach it to an existing HTML node (while executing all scripts)?

Two ways to develop a web app: Either the "classical" way, completely reloading the page with each request, or the "API" way, that is make the server only send JSON data and make the client fetch it ...
0
votes
0answers
225 views

Drupal 6.x Vulnerablity

Is there is any Loophole in Drupal 6.x where the vulnerability leads to admin account access? I heard about "Drupalgeddon 2" this attack can exploit any version of Drupal 6.x, 7.x and 8.x but Drupal ...
0
votes
0answers
281 views

How to find the right exploit for a web application automatically in metasploit?

I am writing a tool in order to detect and exploit possible vulnerabilities in web apps or software automatically. Therefore, firstly my tool finds a possible vulnerable path and gives it to an ...
0
votes
0answers
58 views

How user can change the tty information (related to CVE-2017-1000367)

Recently Red Hat fixed an important vulnerability in sudo: https://access.redhat.com/security/cve/cve-2017-1000367 From the description: A flaw was found in the way sudo parsed tty information ...
0
votes
0answers
73 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
0answers
51 views

Securing Home router without My access

We live in a small village that has some ISPs who don't really care about security. They added a router to the line that probably has a security flaw and should be fixed. The main problem is that I ...
0
votes
0answers
784 views

How to exploit web browsers sandbox?

I have read a few articles about researchers being able to use flash or java vulnerability to bypass web browsers sandbox and hack a system. Can someone explain how such attacks work? Here is an ...
0
votes
0answers
38 views

If my WCF service is compromised, does this put the rest of the network in danger?

I have written a WCF service to act as a back-end for a Database. This database has no information which could be classified as extremely sensitive (e.g banking and payment information). But since it ...
0
votes
0answers
239 views

Any known Dlink DIR 600M vulnerabilities?

Is there any known router authentication / login vulnerabilities or exploits for D-Link DIR 600M rev C1 firmware v3.02? The vulnerabilities of DIR 600 rev A and rev B are fixed in this model. Heres a ...
0
votes
0answers
93 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
0
votes
0answers
904 views

Developing exploit with limited buffer space on Windows XP SP1

I am working on an exploit that has a very limited buffer space on Windows XP. DEP is disabled. The binary is a socket server that has a accepts commands, in one of those commands there is a stack ...