Questions tagged [security]

Topics relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE: https://security.stackexchange.com

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

how can I use lets encrypt when routing through CloudFlare?

Lets Encrypt only works then the domain name used is pointing to the server. When you use CloudFlare (or similar), the domain name does not point to the final destination server. What is the best way ...
Nicolaas Thiemen Francken's user avatar
0 votes
0 answers
11 views

Android Self-Formatting in Response to Boot Mode

I am attempting to enhance the security of my phone to make it "tamper-resistant." Specifically, I want the device to automatically format itself and erase data when connected to a computer. ...
Brosi_learn_fast's user avatar
0 votes
0 answers
10 views

Is changing my IP to test websites a violation of GDPR [closed]

My company is US based and we host and creates websites. Some websites are hosted in europe and some in the US, both are accessible to the EU though. We were wondering if for example there was a bug ...
Nasor c's user avatar
-3 votes
0 answers
18 views

Identifying emails containing maleware [closed]

I have received three strange emails from UPS. Is this spam or malicious code? ** Thanks for reaching out. Verify Button not working? Copy and paste this link to your address bar ypgcpa kklg Dear ...
PooleCool's user avatar
0 votes
0 answers
21 views

Is there an effective method to secure an API from unauthorized usage when the API is employed on a non-authenticated website?

I have created an online game for a website. The game uses its own API. However, I want only the game to be able to use the API. Normally, you could solve this by using an API key, but the issue is ...
Timtendo12's user avatar
0 votes
0 answers
11 views

Use ressourceNames field in kubernetes RBAC that grants access to logs

I want to provide access to logs through a ClusterRole as follows kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: logs-reader rules: - apiGroups: [""] ...
pkaramol's user avatar
  • 16.6k
0 votes
0 answers
7 views

How can I set up a github fine-grained token to push a tag?

I'm trying to push a new tag to my existing github.com public project. In the past I've used "legacy" tokens because setting up the fine-grained token never worked. Now I'm trying to figure ...
Graeme Perrow's user avatar
0 votes
0 answers
6 views

Best Practices for Creating a Subscriber or Membership System

I would like to inquire about how to create a subscriber or membership system. Is it as straightforward as adding a "type_member" column to the database? If not, what other factors should be ...
Diki Candra's user avatar
0 votes
0 answers
9 views

Need Guidance With Virus Removal (Website)

We designed the website in Webflow without copying the code files from WordPress (the website was developed in WordPress). We created the same design in Webflow, and we want to clear the spam urls ...
Muhammad Ibtehaj's user avatar
0 votes
0 answers
8 views

CVE Security golang ubuntu 20.04

Can anyone help me to find and update the package for golang on ubuntu 20.04 ? After trivy image container scanner found some HIGH cve security but searching on the ubuntu I dont have these packages: ...
Petrisor Petrisor's user avatar
0 votes
0 answers
11 views

How could I keep track of an object in my OAUTH2 flow? [closed]

I have a web app where the user can create an object A and then access an external API from object A. So object A keeps track of the access and refresh tokens. Now, I like to allow the user to create ...
User12234327832's user avatar
-2 votes
0 answers
14 views

What are the mechanisms to detect and mitigate DDoS attacks in IoT ecosystems? [closed]

Preventing and mitigating DDoS attacks on IoT ecosystems involves a multi-layered approach that combines proactive device management, network monitoring, and strategic response plans. A consolidated ...
KritilabsTechnologies's user avatar
0 votes
0 answers
17 views

Is the React Native Image component affected by the libwebp vulnerability (CVE-2023-4863)?

On September 11th, 2023, a vulnerability was assigned CVE-2023-4863, the bug was found to be in the WebP Codec image rendering library (libwebp). The WebP Codec library is a library used to encode and ...
FiveDollarMilkshake's user avatar
1 vote
1 answer
31 views

How does server verify geolocation data received from client?

How do location-based apps securely verify client locations on the server-side? Location data is vulnerable to manipulation, with users using VPNs or analyzing network history to send spoof API ...
Mason's user avatar
  • 136
-1 votes
0 answers
15 views

Single Device Only Active

I'm creating a case study and I can't find the name for the feature like in Snapchat when your Snapchat is open on your phone but you logged it in your ipad your account will automatically be logged ...
bernie's user avatar
  • 1
-1 votes
1 answer
39 views

Is it the same as using SSL if I implement security logic similar to SSL on my webpage?

Assuming that my page doesn't have SSL. Let's suppose the following steps: User makes a request to my webpage (let's call it www.mypage.com). Client-side JS makes a SYMMETRIC KEY. Client-side JS ...
Victor Lucas Mazzotti's user avatar
0 votes
0 answers
52 views

Generating 16 character registration codes [closed]

I'm looking for a review on some code i've written and suggestions for security improvements. The code itself is fairly simple. My class assigns numerical values to the letters A-Z and numbers 0-9 ...
John Aldrich's user avatar
0 votes
0 answers
19 views

If a .gz file was downloaded can it demage my computer or steal data?

I was unaware that I was on a datafishing landing page (it was very clever, I haven't seen anything like this before) and I downloaded a .gz file. After that it started to become suspicius so I ...
Bálint Forgács's user avatar
-3 votes
0 answers
26 views

Excel 365 Security [closed]

I'd like to protect an excel file so that it's only able to be opened, even after being downloaded, by someone logged into a corporate 365 account. Essentially making the file useless to anyone not on ...
Mark Poechman's user avatar
-2 votes
0 answers
54 views

High risk security acunetix in laravel

I have laravel website, and i tried to check it with acunetix,and the result is my website have 1 high risk that is weak password. And in details it's said username admin password master. In details ...
Elang M Riefki A's user avatar
0 votes
0 answers
31 views

Spring Security 5 Oauth configuration with external clientName parameter and ThymeLeaf

Our app has a controller mapping ("/newsociallogin") that takes a request param String type (i.e. "google" or "apple") from an external site and then tries to ...
kpdude's user avatar
  • 1
0 votes
0 answers
15 views

Information Rights Management (IRM) causing issues in files hosted on Microsoft Teams

I was hoping to find some answers to this issue of IRM. I've noticed some word documents with sensitivity labels (highly confidential) we were experimenting with and hosted on 'files' on Teams do not ...
KayOb's user avatar
  • 1
0 votes
0 answers
17 views

All the requests that I make are visible in the network tab of the developer tools when I inspect the web page using F12 (i'm using flutter web)

i'm working on flutter web project , i'm using dio package to make the requests like this And this how i call the function : The problem is : if i press f12 to open the dev tools (or right click and ...
pola wahba's user avatar
0 votes
0 answers
8 views

Device Tokens FCM [closed]

I am trying to use firebase cloud messaging. I am currently authenticating and filtering users via device tokens. However, how safe is it to use these tokens? Is there any way to add a server key or ...
jonamsalem's user avatar
-1 votes
0 answers
28 views

Building Botnets using byob framework

So I gave been trying to install the byob framework so as to be able to development botnets but I have this issue with flask module that I cant seem to understand. Error message Running C2 server ...
Malik's user avatar
  • 1
0 votes
0 answers
122 views

Using Selenium inside Flask App requires --no-sandbox when running in Docker

I have a Flask app that uses Selenium Chrome WebDriver to log in to a website and scrape some sensitive data off of it and securely store it in an encrypted file. Everything works perfectly locally. I ...
drose56's user avatar
0 votes
0 answers
22 views

status code 400 when using CYLANCE OPTICS API

I'm trying to use the Cylance Optics API to isolate a device with the lockdown device function, however when executing the API query I get the feedback that the lockdown_type is necessary. status code ...
DovanKing's user avatar
0 votes
0 answers
8 views

Pulse Secure - How to install it on NIXOS

how can i install Pulse secure client on my Nixos computer please I have tied this "https://discourse.nixos.org/t/build-package-module-for-closed-source-binary-package-pulse-secure-vpn/29628/16&...
Rayden Wins's user avatar
0 votes
0 answers
10 views

Handling User Authentication in a MERN Stack Application

I'm currently working on a MERN (MongoDB, Express.js, React.js, Node.js) stack application and I'm in the process of implementing user authentication. I want to ensure that the authentication system ...
Asad Ali's user avatar
0 votes
0 answers
44 views

MS Access Security warning pops up when opening an MS Access accde file located in a Trusted Location

I can't get rid of the MS Access Security warning when opening an MS Access accde UI file located in a Trusted Location. Despite reviewing lots of information on the subject, I've obviously missed ...
Oxian's user avatar
  • 1
0 votes
1 answer
24 views

Counter for Rate Limit on Cloudflare for Different Endpoints in Request Traffic

I have 3 API endpoints which need same rate-limiting on Cloudflare. So, I have clubbed them together. The rule goes like this: If incoming requests match: Host = "https://www.x.com" AND URI ...
Srishti Gupta's user avatar
-1 votes
0 answers
15 views

chkrootkit found an executable in tmp called pnpm, what to do? [closed]

I ran chkrootkit on my Ubuntu system, it found this file: Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed This returned a lot of ...
XXX's user avatar
  • 74
0 votes
0 answers
14 views

React Native - security issue sensitive information in memory dump

I am facing some security issues on my React Native App, specifically for Android. I am using Fridump to run some penetration testings and see what is on memory. https://frida.re/docs/android/ https://...
Franklin Velásquez's user avatar
0 votes
1 answer
18 views

Encryption using L2CAP Connections over channels

In Bluetooth Low Energy, does anyone know if the Security Manager can be used with L2CAP connections over channels? Meaning when I transfer data over a custom L2CAP channel, is there anyway to ...
reedm60's user avatar
-1 votes
0 answers
22 views

Gaining root access exploiting samba 2.2 vulnerability (Kyoptrix 1)

I am getting into the ethical hacking field and I follow along this tutorial: https://www.youtube.com/watch?v=sH4JCwjybGs&t=9922s I am in the situation where I have set up the Kyoptrix machine, I ...
Dimitris Gavriil's user avatar
-2 votes
1 answer
30 views

Java security status 403

I've configured simple security based on JWT tokens and roles. I've tested in in postman and every request have status 403 forbidden. I have no idea what is blocking my requests because even if i ...
Bartolinio Kooperinio's user avatar
0 votes
0 answers
6 views

Unable to Use -json Flag with Nuclei for JSONL Output

I'm currently utilizing Nuclei and attempting to use the -json flag to get the output in JSONL format. However, I receive an error stating flag provided but not defined: -json. The command I'm using ...
Saber BoukHriss's user avatar
0 votes
0 answers
60 views

Are the Ciphers ECDHE-RSA-AES128-SHA256 and ECDHE-RSA-AES256-SHA384 strong?

As part of security improvements I have disabled TLS 1.0 and TLS 1.1 in AWS Load balancer by selecting the below SSL security policy. ELBSecurityPolicy-TLS13-1-2-2021-06 Once this policy is ...
Rob Wilkinson's user avatar
0 votes
0 answers
18 views

Shared internet behind firewall [closed]

We’ve been trying to connect our new site to the internet, a lot of time and effort has been put into this process, however, landlord has rejected the excavation work, ISP company have a very bad ...
A Taha's user avatar
  • 1
-1 votes
0 answers
25 views

Spring Security filter with a second-order priority is not running

@EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) public class SecConfTest { @RequiredArgsConstructor @Configuration @Order(1) public static class ...
Ayshan Rzayeva's user avatar
0 votes
0 answers
21 views

Noob question about how to add mod_sec rule exeption [closed]

maybe someone with experience or basic knowledge that knows what they're doing (unlike me :)) can help.... Currently, I have Ubuntu 20.04 installation with OpenLitespeed and Cyberpanel. I've installed ...
VforVendetta's user avatar
1 vote
0 answers
30 views

Javascript to detect if enhanced spell check is enabled in browser

Chrome and Edge have an option to spell check form contents as its typed in by the person completing the form. Spell checks can be off, on or enhanced. When enhanced is chosen the contents of the form ...
Curious User's user avatar
0 votes
0 answers
26 views

What steps should I take to properly protect user input in PHP? [duplicate]

What steps should I take to properly protect user input in PHP, so that I can prevent SQL injection and XSS attacks, while still allowing certain HTML tags? Is there a reliable function or method that ...
UpzOnline's user avatar
-1 votes
1 answer
30 views

How can I securely transfer files between two remote servers? [closed]

I'm currently engaged in a project that involves the frequent transfer of sensitive files between two remote servers. My primary concern is to establish the highest level of security possible to ...
UpzOnline's user avatar
0 votes
1 answer
72 views

error in trivy Vulnerability scanning: filesystem scan error & misconfiguration scan error

I am using Trivy to scan for Vulnerability scanning in the GitLab CI CD pipeline. When I use $ trivy fs --exit-code 0 --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --scanners vuln,config ./. --timeout $...
Ashish Karpe's user avatar
  • 5,108
-7 votes
0 answers
73 views

How can I secure MySQL data from being exposed through the Inspect Element feature in PHP?

I am working on a large Unity project (For all platforms, but the primary focus is on WebGL) and need to establish secure communication between C# > PHP > MySQL. I've encountered a serious ...
Antonio Gorisek's user avatar
-1 votes
0 answers
18 views

This link may be harmful blue screen through sendinblue emailing

I recently launched an emailing campaign with Brevo (ex sendinblue) to about 200 people (zero bounce, all good contacts). After a few hours, the links from this email were all blocked: whenever you'd ...
Karine C.'s user avatar
0 votes
0 answers
23 views

What to say to the user when the username or email is already taken? [closed]

I have a basic question... When the user is in the signup and the username or email is already taken,which of this is good idea (no both just one of them) : "The email or username is already ...
nepko's user avatar
  • 21
0 votes
0 answers
12 views

Should I attach a different Firebase AppCheck token to each request?

I am developing a React Native app, we got some a couple bruteforce attacks so we want to protect our backend with Firebase Appcheck. Is it useful to use a new token for each request ? Is it worth ...
cbdev's user avatar
  • 275
0 votes
1 answer
28 views

Would this setup be secure enough or is there something to improve?

I want to build an application using Laravel and Vuejs with a chat feature. I'd like to use end-to-end encryption and do know how end-to-end works itself (at least I think I do). Now there is the ...
Atronix's user avatar
  • 39

1
2 3 4 5
1125