Search Results

The website in question is a broad mapping/GIS application that does not feature any monetary transactions whatsoever. … What security vulnerabilities come with implementing such a feature? Our client is not entirely without technical knowledge so a general explanation is enough. …

There are numerous such services available with varying feature sets, and they are popular for powering contact forms on statically generated sites. … If there were ever a security vulnerability in that process which did not depend on specific PHP code, it could be exploited. …

What is Heartbeat - the compromised TLS feature? To set up a TLS connection there's a negotiation that's relatively expensive (it takes time). … For completeness, I should mention that this vulnerability should affect anything that may use the OpenSSL library to perform TLS, which isn't limited to webservers; e.g., FTPS servers (but not SFTP), …

Is my system vulnerable? If your bash isn't vulnerable then your system isn't vulnerable. … The vulnerability is in a bash-specific feature and other shells such as dash and ksh are not affected. …

Since then, I have deleted the shells, fixed the vulnerability and blocked the IP address of the hacker. Can I do something to punish the hacker since I have the IP address? …

Speculative execution is a feature of modern processors that comes as an optimisation. … Which platforms and which CPU are vulnerable? Most of the Intel CPU are vulnerable to both attacks. AMD CPU seems to be only affected by Spectre. …

Hence the question: Is there any confirmed evidence of actual use of cyber-warfare exploiting the vulnerable GPS data? If so, what are they? …

Below are the things an attacker can do if there is XSS vulnerability. … Stealing HTML5 web storage data - HTML5 introduced a new feature, web storage. …

The whole point of running Web things as a non-root user is damage containment: in case the Web server process gets hijacked through some vulnerability, at least the attacker won't obtain full control … But if you give www-data a way to run every command it wishes to, with the rights of any user (including root), and without any further authentication, then you just lost that damage containment feature …

Using techniques like spam email, message board posts, IM messages, Social Engineering Toolkits this vulnerability can be very dangerous. … Take a look at RSnake Stallowned "attack" which took out Amazon's book preview feature. Quite funny reading. …

I contacted developers of this library and got the following reply: "This feature is to prevent some attacks on RSA keys. … I knew only of using 3 with improper padding being vulnerable. Is that really so? Surely, I can use another library, but after such answer I worried about security of my solution. …

It is somewhat speculative why exactly the Sandbox remains vulnerable. … As a result, it is quite possible for a developer to forget about that obscure feature when changing the Java API or its implementation, accidentally exposing things that should be protected (to illustrate …

In short - from my understanding the vulnerability is caused by: treating data for logging as trusted, even though they might come from an untrusted source (like logging the user agent of a HTTP request … Unfortunately this feature was until log4j 2.15.0 enabled by default, even though logging often includes untrusted user input, e.g. logger.debug(userInput). …

Additionally, you have to assume that an attacker with physical access can find a local elevation-of-privilege vulnerability at some point. … This feature is generally available, through either built-in functionality or third-party software, for most operating systems. It's got weaknesses of its own, though. …

In the normal case (no vulnerability to allow arbitrary code execution) it all depends on the Bluetooth profiles supported by your device. … (See below) Assuming encryption is a security feature that can be enabled, is it required or is it optional? As in the previous question, it's implementation-dependeant. …