Skip to main content
Share Your Experience: Take the 2024 Developer Survey
57 votes
Accepted

How do open-source projects prevent disclosing a bug while fixing it?

They don't. By releasing code, they automatically "disclose" the issue to those who can reverse engineer the patch. But they can delay explaining or providing the details for easy ...
schroeder's user avatar
  • 131k
32 votes
Accepted

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them ...
Tom K.'s user avatar
  • 7,966
20 votes

How do open-source projects prevent disclosing a bug while fixing it?

The same way they prevent disclosing the report: by not disclosing it. Since you mentioned the Linux kernel specifically: only a vanishingly small number of users build their kernels directly from the ...
Jörg W Mittag's user avatar
17 votes

How do open-source projects prevent disclosing a bug while fixing it?

Coincidentally I have a tab open about CVE-2020-17640 in the Eclipse Vert.x project where the product maintainers are discussing this exact issue! Julien Viet 2020-09-28 13:07:31 EDT So I just need ...
Mike Ounsworth's user avatar
10 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or ...
mgjk's user avatar
  • 7,525
8 votes

What does a "-" mean in the Version field in Common Product Enumeration (CPE)?

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA: "It is often necessary to use a CPE Name when identifying a specific release of a given platform....
Jason's user avatar
  • 101
7 votes
Accepted

Are inactive vulnerable Wordpress plugins still unsafe?

Depends on the plugin, they can be if there is say a PHP script that can be called directly (doesn't depend on wordpress code or includes the right statements to load the wordpress libraries it needs)....
ewanm89's user avatar
  • 2,053
6 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

First of all you need to have a scope of what you are scanning for and what you are reporting on. For example is the scope of the scanning to discover and report on all vulnerabilities including low ...
TheJulyPlot's user avatar
  • 7,809
6 votes

How Vulnerability scanners assign CVE codes to Vulnerability found

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to ...
Jenessa's user avatar
  • 1,106
5 votes

What to do if you think you discovered a zero day vulnerability? (white hat style)

There is An ISO dedicated to this subject https://www.iso.org/standard/45170.html It is generally accepted to work with the vendor affected and give them time to resolve the issue within a reasonable ...
Greg's user avatar
  • 81
5 votes
Accepted

What risk rating models are used for calculating risk scores of web vulnerabilities?

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, ...
atdre's user avatar
  • 19.1k
5 votes

Adobe Flash and Meltdown / Spectre

I cannot find any official statement from Adobe about the problem. But, Flash seems to have bytearrays shared between workers which are similar to SharedArrayBuffer in Javascript and probably can be ...
Steffen Ullrich's user avatar
4 votes
Accepted

WD My Cloud Vulnerabilities - What is at risk?

MyCloud is a service that runs on the NAS. The exploits documented on the site you link to allow three different things: 1) Bypass login and pose as a MyCloud administrator 2) Place files anywhere ...
Out of Band's user avatar
  • 9,283
4 votes

Why are the CVSS scores differ so much between Redhat and NVD page?

Working out the inputs to the calculations is very subjective: Take the CVSSv2: RH: AV:N/AC:M/Au:N/C:P/I:P/A:P NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C Both agree the Attack Vector is Network, and the ...
Douglas Leeder's user avatar
4 votes
Accepted

How to fairly pay out bug bounties without going over budget?

You are the vendor, so you make the rules. Just be clear about them. Problem is we only have a limited overall budget and dont want to promise anything we cannot pay. Then be clear about that. It'...
Arminius's user avatar
  • 44.8k
4 votes
Accepted

vulnerability management 101

This entire thing boils down to one simple concept: risk management. You have a piece of software that gives you raw information about potential threats. Now you go through the process you outlined: ...
schroeder's user avatar
  • 131k
4 votes

Security for a Windows application running in a corporate network

Yes, it is important to fix vulnerabilities inside a corporate environment, even if these hosts are not internet-facing. Why? Because if the endpoint is used by an employee, it can be compromised via ...
Solo's user avatar
  • 56
3 votes

Are there any Common Weakness Entries (CWEs) applicable for hardware security weaknesses?

Yes. There is now the Hardware Design CWE View. It lists CWEs such as: CWE-1247: Missing or Improperly Implemented Protection Against Voltage and Clock Glitches CWE-1248: Semiconductor Defects in ...
the_endian's user avatar
  • 1,179
3 votes

What risk rating models are used for calculating risk scores of web vulnerabilities?

CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to ...
Colin Cassidy's user avatar
3 votes
Accepted

Can a CVE be removed from NVD database?

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked '...
hiburn8's user avatar
  • 460
3 votes

What is difference & link between threat modelling and vulnerability assessment?

Answer based on personal experience. Vulnerability Assessment := Do we have a software bug with a security implication? ie is there a bug in the source code that needs a patch? Threat Model := What is ...
Mike Ounsworth's user avatar
2 votes

Where can I find real life examples of software vulnerabilities in OSS?

Check out exploitdb by Offensive Security: https://www.exploit-db.com/
kaidentity's user avatar
  • 2,654
2 votes

Vulnerability management solution evaluation criteria

Bandwidth requirements System requirements Training offerings Reporting Accuracy (number of false positives) Time to scan Extra offerings Example: Nessus has web app tool; Nexpose doesn't ...
zerocool's user avatar
2 votes
Accepted

How does Server-side Handle the same multiple requests at the same time?

The way that a programming language runtime ensures that concurrent requests that target the same state don't interfere with one another is ultimately through a mechanism called "compare-and-set" ...
Jonah Benton's user avatar
  • 3,507
2 votes
Accepted

Why is MITRE not changing CVE entries that are clearly incorrect?

I have gotten CVE entries corrected previously, but not consistently. I think it depends on how much they have to do to verify in what you tell them. If you can show internal inconsistencies (e.g. ...
Swashbuckler's user avatar
  • 2,205
2 votes

How to determine the minimum Linux Kernel version required for a given vulnerability

Someone has to analyze the code manually to find out when the vulnerability was introduced. If someone isn't telling you what version it was introduced in (which usually is only the case with high-...
forest's user avatar
  • 66.8k
2 votes
Accepted

What is the difference between patch management and vulnerability management?

To find out the differences let's look at what these types of management actually do first. Patch Management Patch management includes the planning, acquiring, testing and installing of changes to a ...
Tom K.'s user avatar
  • 7,966
2 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

If someone makes a buying decision, they might say "this router supports DNS resolution in the router. We don't use this now, but we might do so in the future, so we buy this router and not a slightly ...
gnasher729's user avatar
  • 2,394
2 votes
Accepted

Why are the CVSS scores differ so much between Redhat and NVD page?

Unfortunately, CVSS ratings are always more individual than desired. See my question CVSS Score Remote or Local Scenario for an example of such a discussion. I am responsible for the CVSS rating on ...
Marc Ruef's user avatar
  • 1,130
2 votes

Is it recommended to patch announced vulnerability for unused services or features?

This is a risk assessment and threat modelling style question - rather than a hard yes or no. Do you want to accept the risk of not patching the service, which could be exploited in the future - ...
ISMSDEV's user avatar
  • 3,280

Only top scored, non community-wiki answers of a minimum length are eligible