4

Yes, it is important to fix vulnerabilities inside a corporate environment, even if these hosts are not internet-facing. Why? Because if the endpoint is used by an employee, it can be compromised via phishing, malware, breached VPN access or similar means. This means your idea of a "safe environment" doesn't hold up to reality. If your security is ...


3

... it does not "talk to the internet ... There is a difference between does not usually talk to the internet or is not able to talk to the internet. As long as the application is not somehow sandboxed or firewalled some exploit can likely make the application talk to the internet. ... this application is a local tool only ... Just because it runs ...


2

Arbitrary code execution, allows an attacker to run any code target system. Based on the Attack Vector we can divide the arbitrary code execution into two categories: remote and local. In general, I would say that remote code execution is more severe as the name suggest can be exploited over the network, which is much more dangerous in those days when ...


2

Answer based on personal experience. Vulnerability Assessment := Do we have a software bug with a security implication? ie is there a bug in the source code that needs a patch? Threat Model := What is the environment in which this bug exists? ie is the vulnerable code actually reachable in our application? Is it only reachable by trusted admins? So you might ...


1

There's a couple different parts here which seem somewhat jumbled. First, the remedial action listed here seems to correspond to a different vulnerability than the finding. It sounds like the finding is the one you're confused about though, so I'll try to answer that. Specifically, this relates to exposing a web application both on a vhost and directly on ...


Only top voted, non community-wiki answers of a minimum length are eligible