Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

6
votes
0answers
76 views

Is it possible to get infected by opening an email in Android Gmail app?

I just received an email from an unknown person, titled "da vinci" and containing a docx file with the same name. Not suspicious at all, right? I have not opened or downloaded the file, but: The ...
5
votes
0answers
57 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
3
votes
0answers
186 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
2
votes
0answers
48 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
41 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
2
votes
0answers
243 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
2
votes
0answers
104 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
2
votes
0answers
80 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
2
votes
0answers
164 views

How does biometric authentication work from a technical perspective?

Together with a colleague, we discussed the way of biometric authentication and how this works out. Both of us are only interested in security but far from being an expert on the technical side. ...
2
votes
0answers
87 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
2
votes
0answers
267 views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
2
votes
0answers
234 views

Clarification on DH groups

Nikto reports the following via the "ssl-dh-params" NSE script: Check results: | WEAK DH GROUP 1 | Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | Modulus Type: Safe ...
2
votes
0answers
146 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
1
vote
0answers
39 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
1
vote
0answers
17 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
1
vote
0answers
49 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
1
vote
0answers
130 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
0answers
84 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
1
vote
0answers
42 views

A database query error in Wikimedia 1.27.4

I have a website running Wikimedia 1.27.4 , When I insert (--) symbol in search box I get this error message A database query error has occurred. This may indicate a bug in the software. I got some ...
1
vote
0answers
484 views

Side channel attack with flush+reload

I have been reading about cache side channel attacks and the "Flush+Reload" method came up a decent amount. Before putting forth my question, this is what I understand about the Flush+reload technique....
1
vote
0answers
119 views

Quantifying security with metrics

I am working on a state-of-the-art quantification of security, meaning a numerical assessment of security for a system. In my research, most of the work is not recent (up to 2012 so far) and is ...
1
vote
0answers
67 views

IBM Appscan vs Flaw finder

What is the main difference between an open source tool like flaw finder and a costly commercial tool like IBM Appscan. One is reporting that we get a presentable report with commericial tools but is ...
1
vote
0answers
164 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
350 views

/var/www/cgi-bin/webcm vulnerability

I opened my apache error logs today and found this: [Fri Apr 28 06:52:59.219655 2017] [cgi:error] [pid 25030] [client 172.30.0.155:12810] script not found or unable to stat: /var/www/cgi-bin/webcm I ...
1
vote
0answers
21 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
1
vote
0answers
152 views

Exploitability of Heap Vulnerabilities

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list ...
1
vote
0answers
41 views

Protection against remote system compromise on binary code level

My (certainly incomplete) understanding of a remote system compromise on the binary code level is roughly: A program vulnerability, such as missing input validation, is exploited to insert external ...
1
vote
0answers
206 views

Countermeasure for privilege escalation for TeamPass

I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
1
vote
0answers
101 views

Finding Vuln in linux login console

I'm trying to find vulnerability on an appliance based on Ubuntu 12.0.4 and this is about console (COM port) section now. my findings: The password field is sensitive to large string. for example if ...
1
vote
0answers
149 views

Internet Explorer WScript Shell Enabled

While testing a company's systems security, I found out that they have allowed WScript.Shell to run in all of their Internet Explorer for Intranet websites. It works if you open HTML files in your IE ...
1
vote
0answers
183 views

How to craft Invalid packet to test for TLS Poodle vulnerability?

I need to test if a server is vulnerable to TLS Poodle. To do this I need to send an invalid packet to the server and check if it closes the connection. But I am not sure how I create that packet (...
1
vote
0answers
616 views

Vulnerabilities in Scala web applications

I want to create a server side web application using Scala. Are there any classes of web vulnerabilities that are unique to Scala? I tried to search on the web for Scala-specific vulnerabilities, ...
1
vote
0answers
168 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
1
vote
0answers
280 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
348 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] vulnerable ...
1
vote
0answers
152 views

Struts2 + action prefix vulnerability + CVE-2013-4310

CVE-2013-4310 indicates the action prefix (action:) feature of struts2 framework is vulnerable. Hence the vendor released the patch(?) by disabling this feature. However, there is an option to enable ...
0
votes
0answers
34 views

Bad Connections Blocked

With a new Windows 10 computer, McAfee Livesafe is reporting nearly 20,000 bad connections blocked. I ran some tests from Gibson Research, including the UPnP Exposure Test and the All Port Scan. The ...
0
votes
0answers
79 views

encrypting TCP and UDP with self signed cert

I don't have much experience in computer security and I am developing a server for a project. I'm using a tcp connection and UDP packets for some real time data transmission. I want both of these ...
0
votes
0answers
32 views

TLS Robot testing with robot-detect.py script

Has anybody tested TLS Robot Vulnerability in Qualys WAS with robot-detect.py script (https://github.com/devsecur/robot-attack)? How to run the script for on an internal IP if there writing on step 3....
0
votes
0answers
27 views

Are there any Nuget pkg upload vulnerabilities

I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, ...
0
votes
0answers
51 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
0
votes
0answers
121 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
0
votes
0answers
126 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
0answers
287 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
0
votes
0answers
76 views

Why 6.7 version of image magick can be exploitable even it is Vulnerable version?

I have installed a vulnerable version of the image magick i.e. 6.7 and according to this CVE-2016–3714 it is a vulnerable version. Now why I downloaded it because to get a clear picture of this ...
0
votes
0answers
62 views

Is it inherently insecure to fetch HTML and JS content from server and attach it to an existing HTML node (while executing all scripts)?

Two ways to develop a web app: Either the "classical" way, completely reloading the page with each request, or the "API" way, that is make the server only send JSON data and make the client fetch it ...
0
votes
0answers
59 views

How user can change the tty information (related to CVE-2017-1000367)

Recently Red Hat fixed an important vulnerability in sudo: https://access.redhat.com/security/cve/cve-2017-1000367 From the description: A flaw was found in the way sudo parsed tty information ...
0
votes
0answers
79 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
0answers
854 views

How to exploit web browsers sandbox?

I have read a few articles about researchers being able to use flash or java vulnerability to bypass web browsers sandbox and hack a system. Can someone explain how such attacks work? Here is an ...
-1
votes
0answers
52 views

How to determine if a “Windows Security” popup is genuine?

I wrote a program that access the Windows Certificate Store. I then get this popup: But it is not a UAC type popup so I can then easily write a "fake" popup to slurp passwords. How to ensure this ...