New answers tagged disclosure
-1
Anywhere you like, if at all.
Ricoh MFPs can lock up if you look at them funny, let alone send them a specially crafted postscript file. If you've found yet another way of making them crash perhaps post about it on your favourite comment site/write it up on your blog but it's probably not going to get Ricoh or their customers particularly bothered (as you'...
0
You have not described a vulnerability or an exploit. You've described a weakness in the operation. Every single anti-malware detection process will have weaknesses. These do not qualify for CVEs.
36
You should request a CVE ID from MITRE (https://cve.mitre.org/cve/request_id.html), which is the responsible CNA for this.
You can then disclose it on security mailing lists like Bugtraq or FullDisclosure. Security magazines and news sites might also be interested in the vulnerability. You can contact them directly and ask if they are interested to publish ...
10
If you want to disclose a vulnerability I would suggest to contact the right CNA. You can find a list under this link. Now you can request a CVE ID and everything goes on if this vulnerability is really existing.
0
In a well architected system, no one vulnerability should be enough to provide easy access to any attacker. For example perhaps a critical bug is discovered in PHP, but you are running mod_security in nginx, and you have cleaned up unreferenced files, and you have the minimum permissions necessary on your filesystem, and the database user can only run stored ...
0
You should contact the respective CERT (computer emergency response team) for your country and let them know about this issue, they will handle all the rest.
Don't contact them directly, for that could get you into serious legal trouble.
Top 50 recent answers are included
