Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

Filter by
Sorted by
Tagged with
1
vote
0answers
28 views

Crowdstrike Sensors - Do they need inbound, as well as outbound access? [closed]

As per the title, I'm looking for insight on the crowdstrike sensor. Does anyone know if, on top of the outbound pt:443 access to the domains it requires, whether it also requires inbound connectivity?...
1
vote
1answer
110 views

vulnerability management 101

Looking at a typical vulnerability scan report from Nessus or Qualys most people are terrified, lost, and basically with more questions than answers. For example, how on earth am I going to deal with ...
2
votes
0answers
33 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
51 views

Is rsyncd secure? (except for the lack of transport encryption)

I have been using an rsyncd server for backups for what feels like a decade. I saw that rsyncd has no transport encryption (not even for username and password). I wonder what other security issues ...
0
votes
2answers
116 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
1
vote
1answer
63 views

CGI-BIN - suspicious activity (unknown IP made request)

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...
0
votes
1answer
42 views

How to handle as a Tester if the website is kicking out the user for recreating the session?

Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! ...
4
votes
1answer
661 views

Does “emergency mode” help protect iOS devices in AFU mode?

In recent iOS devices you can temporarily disable unlocking via biometrics by holding the power button and either volume button for a couple seconds. I’m trying to find out if this does anything to ...
0
votes
0answers
32 views

Is there an analysis/whitepaper out there regarding RCE with ICMP Echos against windows hosts?

I know this might sound silly but given what happened with SIGRed I wanted to ask and see what those who know think: Is there an audit or analysis out there showing the possibility of RCE with ICMP ...
3
votes
3answers
1k views

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?

How can we disable sudo on CentOS 6 to prevent CVE-2021-3156? We cannot remove RPMs or similar. We can only change a configuration. Do we have another fix for CVE-2021-3156 on CentOS 6, except ...
1
vote
0answers
43 views

Is it ok to give the client the power to make any request from within our server?

We have a very heavy endpoint on our server, that takes a few hours to respond. Of course, this would result in a timeout, so we added an "asynchronous" functionality to it. To summarize, a ...
1
vote
1answer
100 views

What are criteria and rules to determine bug bounty amounts? [closed]

How is the reward amount determined on different bug bounty platforms like Bugcrowd, HackerOne or Synack? As a bug bounty program owner I can maybe define some rules for the rewards. What are the ...
2
votes
0answers
39 views

Zip Slip path traversal and consistent vulnerability checks

According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory: String ...
1
vote
1answer
63 views

Vulnerabilities for multiple kernel versions that are installed on a given server

As per Exclude or display vulnerabilities for non-running Linux kernels : It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on ...
0
votes
0answers
59 views

How long does a HiddenEye keylogger script last in an Android browser?

I recently clicked on a phishing link and entered my credentials but then I changed the password. I believe the phisher used HiddenEye with a keylogger script in the webpage so how long can he capture ...
0
votes
2answers
71 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
2
votes
1answer
98 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
-2
votes
1answer
167 views

Nexpose Vulnerability scanner

Is it normal to get 3000+ vulnerabilities while scanning server using Nexpose? Or I can reduce the vulnerability to decent count by some tweaks!
4
votes
0answers
100 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
4
votes
2answers
213 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
0
votes
0answers
49 views

Is malware in an EC firmware a concern, when standard security is in place together with the rest of the computer having no malevolent tampering?

Question My question is whether malware in the embedded-controller firmware is something to worry about if the rest of the computer system is faithfully what it should be, together with standard ...
0
votes
1answer
40 views

can vulnerabilities be treated differently based on ceratin circumstances? [duplicate]

We are running vulnerability scans on our systems. I can see a few XSS vulnerabilities being reported, such as CVE-2020-14173. Let me quote: The file upload feature in Atlassian Jira Server and Data ...
1
vote
0answers
42 views

Remote file inclusion (RFI) found - vulnerability or false positive?

For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
90
votes
6answers
14k views

Why does my IT department block Firefox?

We received a message from the IT bods this week stating: Summary of the issue: IT will disabling and blocking the use of the browser Firefox next Thursday the 03.12.20 on all IT managed devices. Due ...
3
votes
1answer
418 views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
3
votes
2answers
91 views

How to estimate threat and risk associated with that threat and not only vulnerability severity?

Having this simple formula Risk = Threat x Vulnerability x Information Value it is quite difficult to estimate risks quantitatively because of threat estimation seems to me the most difficult part. I ...
3
votes
0answers
82 views

Can/should I automatically report network break-in attempts?

For the last 15 years I've been using SpamCop to report the spam I receive. I do this because it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
0
votes
1answer
44 views

Using outdated ADSL modem with up to date router - Security Concerns

My parents live way out in the middle of nowhere. The only service provider that is not satellite is Century Link, which uses ADSL / phone lines. They wanted me to set them up, and the service guy was ...
1
vote
1answer
79 views

Is it possible for a self-extracting file to run malware on Linux?

I know that you need to change permissions for a file to run as a script on Linux. Is that enough to prevent any malware from being installed by some self-extracting file? Is there anything that can ...
0
votes
1answer
275 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
1
vote
1answer
201 views

Can string concatenation in file_get_contents() be exploited in PHP?

Let's say I have the following PHP code: <?php echo file_get_contents($_GET['path'] . ".txt"); Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
0
votes
1answer
76 views

Is it possible for someone to make a purposefully vulnerable site then take advantage of that vulnerability to hack the users?

Is it possible for someone to make a purposefully vulnerable site then lure users to his site where he then takes advantage of that vulnerability to hack their social media accounts etc? If so how?
0
votes
0answers
54 views

Can python be used to retrieve a session ID to mimic logged in user at periodical times?

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
0
votes
4answers
108 views

Application is validating the file extension but not file content - Is this a security vulnerability?

An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
0
votes
1answer
164 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
1
vote
1answer
117 views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
1
vote
0answers
52 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
2
votes
1answer
144 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
2answers
85 views

Possible SSRF in image tag that takes (partial) user input?

A webapp has an img tag that partially takes userinput like so: <img src="/blah/blah/$USERINPUT.jpg"> where the first / is from the root of the domain. Could there be a vulnerability ...
1
vote
1answer
84 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
1answer
107 views

How can I tell if a program (in this case Jitsi Meet Electron) has bad-enough vulnerablities making it unsafe for current use and/or protect myself? [closed]

I'm uneasy that Jitsi Meet (videoconferencing stack) is Chrome-first (bug relating to other browsers are fixed later) and dislike Chrome for privacy reasons. Jitsi has an Electron desktop web-wrapper ...
-1
votes
1answer
57 views

Is there any document that contains all web vulnerabilities of OWASP? [closed]

OWASP top 10 lists the top 10 web security risks. But I didn't find the other vulnerabilities out of the top 10 in OWASP site. Is there any document that contains all web vulnerabilities?
0
votes
1answer
66 views

Is there any authoritative classification of vulnerabilities?

Is there any classification of vulnerabilities ? As we know, there are many vulnerabilities, such as: SQL injection vulnerability, File upload vulnerability, File contains vulnerability, XSS, SSRF, ...
1
vote
1answer
296 views

Slow HTTP POST vulnerability in IIS 10

I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer. From what I understood from this finding, ...
0
votes
1answer
120 views

Are rich-client apps inherently more secure than webapps? [closed]

If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF ...
0
votes
1answer
48 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
1answer
128 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
0
votes
1answer
53 views

Booting 'live' form the hard disk

I use VeraCrypt for file-container level encryption for all of my files. But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
-1
votes
2answers
110 views

Can someone Inject malicious SQL to my SQL query? [closed]

I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID. Is there a way someone can Inject malicios ...
0
votes
1answer
162 views

What are the security risks of allowing users to add iframes?

In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags. I'd like to allow <iframe> so that users can insert youtube videos and so on. However I'm worried ...

1
2 3 4 5
18