Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
242
votes
4answers
109k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
167
votes
3answers
15k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
125
votes
8answers
19k views

Are there technical differences which make Linux less vulnerable to virus than Windows?

What makes Linux so different than Windows in terms of anti-virus needs? My question is not if I should get an anti-virus for my Linux. I perfectly understand why an AV is important. I would like ...
123
votes
2answers
17k views

How is the Heartbleed exploit even possible?

I have read about the Heartbleed OpenSSL vulnerability and understand the concept. However what I don't understand is the part where we pass 64k as the length and the server returns 64kb of random ...
105
votes
15answers
21k views

How can I argue against: “System is unhackable so why patch vulnerabilities?”

An operating system has reached End of Support (EoS) so no more security patches are coming for the OS ever. An embedded device running this OS needs to be updated to a newer version. However, the ...
91
votes
9answers
12k views

Is it a security vulnerability if the addresses of university students are exposed?

I am sorry for my lack of knowledge in this matter. My university (basically an international university in the UK that has students from different countries) has a website which requires the ...
80
votes
13answers
25k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
80
votes
8answers
20k views

How is 'Removing RAM' a security risk?

Today I was watching a video on 'Ethical Hacking' where, while discussing hardware attacks, the narrator said: Removing RAM or components from a desktop or a laptop Here's a screenshot: I ...
70
votes
3answers
32k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
63
votes
2answers
11k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
63
votes
1answer
6k views

Who “brands” vulnerabilities?

It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who ...
63
votes
3answers
5k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
58
votes
6answers
7k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. ...
55
votes
3answers
22k views

What kind of attack is prevented by Apache2's error code AH02032 (“Hostname provided via SNI and hostname provided via HTTP are different”)?

I saw in my Apache2 server logs messages like [ssl:error] [pid 28482] AH02032: Hostname xxx.yyy.zzz.www:443 provided via SNI and hostname xxx.yyy.zzz.www provided via HTTP are different One of ...
53
votes
6answers
27k views

What can hackers do with ability to read /etc/passwd?

On the exploit websites I see security analysts and hackers targeting the /etc/passwd file when showing the proof of concept. If you have a local file inclusion or path traversal vulnerability on ...
48
votes
2answers
7k views

What is happening now with the Grub backspace key security vulnerability?

I just read a few articles about a new Grub vulnerability. The article said that you can bypass the password protection by pressing backspace twenty eight times. I am a security guy and I am ...
48
votes
6answers
7k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to a ...
46
votes
5answers
7k views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Imagine the following code: ATTACKERDATA="$(cat attackerControlledFile.txt)" echo "${ATTACKERDATA}" An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
45
votes
5answers
24k views

Can malicious code trigger without the user executing or opening the file?

If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger? ...
41
votes
3answers
23k views

Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
36
votes
9answers
12k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
35
votes
6answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
35
votes
1answer
4k views

How does a nonce reset allow for decryption?

I'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption ...
32
votes
2answers
6k views

HTML login form without a CSRF protection

We've recently got a vulnerability report saying that one of our HTML forms in one of the internal applications is not CSRF protected. At first, we could not immediately reproduce it manually using ...
29
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
28
votes
1answer
3k views

How does CVE-2014-9390 affect me?

On 18th December, a vulnerability in git and mecurial was announced.  What are the details of the vulnerability?  Does it affect me?  What should I do?
26
votes
7answers
6k views

Is the unauthorized deletion of data considered a breach of integrity or availability?

I am in the process of writing a security vulnerabilities report on an application used at my employer, having completed an application audit. One discovered vulnerability can lead to unauthorized ...
26
votes
4answers
4k views

What to do when I find a possible security vulnerability of public interest? [duplicate]

Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide. I am not an expert in security, but there ...
25
votes
3answers
6k views

Is it safe to allow www-data to execute privileged commands?

I have noticed several questions on Stack Overflow, like this one, about executing commands with root privileges using PHP. The answer proposed to add the line www-data ALL=(ALL) NOPASSWD: ALL to ...
25
votes
1answer
5k views

What's the security issue with base64 encoding/decoding?

http://phptester.net/ yields the warning WARNING base64_decode() has been disabled for security reasons Why? Besides the obvious vulnerabilities that have nothing to do with base64_decode (...
24
votes
2answers
43k views

What are the main vulnerabilities of TLS v1.1?

What are the main vulnerabilities of TLS v1.1? Actually, no RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except the description given in section 1.2 ...
23
votes
4answers
2k views

Cloudbleed: is it actually important to change ALL passwords?

In response to Google and Cloudflare's recent disclosures of the Cloudbleed vulnerability, some sources like TNW are recommending that people change passwords for sites and services that use ...
22
votes
1answer
3k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
20
votes
2answers
1k views

What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015?

It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's ...
15
votes
2answers
4k views

What are the privacy and security risks associated with Intel's Management Engine and AMD's Platform Security Processor?

And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me? Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely ...
15
votes
1answer
323 views

Why is caller ID spoofing so simple, and catching offenders so hard?

There is plenty of software which allows a user to input a recipient's information, and a fake-originator's information, and the software will complete the caller ID spoof. I'm trying to understand ...
13
votes
6answers
8k views

What pages are vulnerable to SQL injection?

I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
13
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
13
votes
2answers
1k views

How to detect Rowhammer vulnerability?

Related to How to know whether a RAM module is vulnerable to rowhammer before buying?, how can I check whether my already installed memory modules are susceptible to this attack, without having to use ...
13
votes
1answer
6k views

What is WebRTC and how can I protect myself against leaking information that doesn't need to be shared?

What is WebRTC and what is it intended to be used for? According to this Browser Leaks Test for WebRTC and IP Leaks, I am currently leaking IP information for IP addresses that I do not believe ...
13
votes
3answers
839 views

Are virtualized environments vulnerable to the Row Hammer attack?

Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system. To ...
12
votes
4answers
2k views

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
11
votes
3answers
13k views

What is a good XSS vector without forward slashes and spaces?

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
11
votes
3answers
804 views

How can malware immediately infect a Windows XP computer as soon as it goes online without any user action?

This is a thing I used to hear back in the olden days of Windows XP... People were telling me that a computer running on an out-of-date Windows XP system with no antivirus software was getting ...
11
votes
2answers
1k views

How to handle media files from untrusted sources?

I've been a heavy user of ffmpeg-based players and encoders for years, and though I've heard about numerous security issues, I always assumed that staying up-to-date was safe enough. However, I just ...
11
votes
3answers
3k views

How to minimize the risk posed by Intel AMT/ME's “ring -3 exploits”?

This question is about how to minimize the risk posed by Intel AMT/ME's ring -3 exploits? I'm looking for advice on common strategies and practices. Here is my current situation. I am parking my ...
10
votes
2answers
1k views

Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

Okay, I'll just begin with the question and then elaborate a bit below. It is: Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a straight-to-...
10
votes
3answers
7k views

SQL Injection if table structure/db structure not known

could an attacker who'd just found out that you're using mysql make an SQL Injection attack with only this information? If you don't know Any table/db name how come you can find it out? Is that even ...
10
votes
1answer
2k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
10
votes
2answers
1k views

How does the DYLD privilege escalation vulnerability work on OS X?

Just reading about the DYLD privilege escalation vulnerability reported by Stefan Esser at https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html I understand this allows anyone to ...