New answers tagged vulnerability
0
The vulnerability is present in the binary interface that the AJP server provides, and will only be available to Apache HTTPd. Unless the AJP port is exposed to a public network, one cannot exploit it by simply issuing HTTP requests to Apache HTTPd.
1
When that link is clicked, an authentication page would show up in the machines internet browser and show a page where it asks for the user's company ID and birthday.
This is not a safe on-boarding process to prove that a new app user is associated with an identity in active directory. Birthday and company ID are way too public, particularly to other users ...
0
Assuming I'm understanding this correctly, your app works like:
A Company shares a list (possible) users with your app from their Active Directory or similar?
A user from that company downloads the app on their phone and their phone reports the mobile number? (or some other way of getting mobile?)
your app server sends an SMS with a static link in it to ...
-1
A static link proves nothing. Once it's known by an attacker, it's is easily bypassed.
Consider this scenario:
Adversary signs up for your service using invalid@gmail[.]com.
Your server sends registration link to invalid email address. This email bounces or doesn't -- the results don't matter.
Adversary waits about 10 seconds, then navigates to your ...
0
How can I ensure that no traces (i.e. vulnerabilities) of the
dev-marked code is found in the production code? Can I?
While deploying your code in production environment, you should install production only dependencies. This can be done as:
npm install --only=prod
It always best practice to use latest version of dev or production dependencies. There are ...
1
For me, any of the above recommendations is a change that needs to be applied to a given application, host, etc.
Totally agree on that point, and if you have a Change Management Process, all those changes should pass through it.
how can one make sure that any of the changes does not lead to reduced or compromised security? How one can make sure that the ...
0
I would focus more on proactivity, decisiveness, and resilience and do not await the perfection of a change.
Some areas to continuously look for improvements:
Business Decisions and Change Management
mapping and understanding of dependencies
dynamics of business impact assessments
dynamics of the change management process
speed of system security ...
2
Let's take your Node.js example. You are using a version of with a known vulnerability. Therefore you have two options:
Stay on the version that you know is vulnerable
Upgrade to a version that may be vulnerable.
The only correct choice is #2. Is it possible that you are upgrading to a version that also has vulnerabilities? Absolutely! In fact that is ...
1
Lucky13 and Sweet32 are both attacks on SSL/TLS, i.e. these attacks can be used to intercept the encrypted connection between the client and the server. In the case of a server that is vulnerably to Lucky13, an active attacker may be able to launch a MITM attack by exploiting this vulnerability. The same applies to Sweet32, but even a passive attacker may ...
0
Well, first of all you are behind a NAT of a cell phone operator equipment. Secondly, your IP changes frequently - reconnecting to different cell towers will do that (there are many factors to that). Thirdly - there are have to be either zero-day vulnerability or some services running on your phone accepting external requests to be vulnerable.
Phones are ...
Top 50 recent answers are included
