New answers tagged vulnerability
1
It looks like your scanner is checking for backed-up or cached copies of webpages with extensions that would result in the entire file being served as plaintext, leaking the server side code and any secrets contained in it. This may happen either because some text editor left a cached copy of the file or because some developer manually created a backup copy.
...
0
There are some vulnerabilities that will work even when the plugin is disabled. Delete plugins that have vulnerabilities with no patches: inactive plugins aren't doing anything for your site.
For example, Wordfence reported on a vulnerability in the Total Donations Plugin that exploited the following code:
$action = esc_attr(trim($_POST['action']));
//For ...
0
What is most common and secure is to only allow access to the webserver using TLS 1.2 or 1.3. This will naturally prevent older insecure browsers to access your website.
When allowing TLS 1.2, pay attention to its configuration, because some cipher-suites or parameters are not very secure. TLS 1.3 has the advantage to be fine without any particular ...
1
I've also faced this kind of situation. The developers has sanitized " to prevent XSS vulnerability. You cannot get rid of ".
And inside the double quote is a single string while the attribute is value. So, you cannot exploit it. Because to exploit you have to bring input out of the double quote anyway.
1
No, if you can't enter double quotes you cannot escape from the attribute value. See the WHATWG spec for details on how browsers parse attribute values. The possible parser state transitions in that state are:
character
effect
" double quote
end attribute value
& ampersand
parse a character reference
NULL
error, but will continue parse
EOF
...
0
The first thing I would recommend doing is looking at the raw banner data to determine whether the vulnerability information has been verified or not.
There are 2 types of vulnerabilities that can be attached to the banners in Shodan: verified and unverified. Unverified vulnerabilities are vulnerabilities that are implied based on the metadata we've ...
0
Just because a vulnerability scanner identifies that a vulnerability exists in a package or library that you use doesn't mean that it's exploitable in your system. Even if it is exploitable, there may be controls in place that limit who can exploit it that are sufficient to reduce the risk.
Depending on the context, I'd recommend not blindly following the ...
Top 50 recent answers are included
