CVE-2025-59363

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages relates to reading data beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Securing AI Agents: Implementing Role-Based Access Control for Industrial Applications

The emergence of Large Language Models LLMs has significantly advanced solutions across various domains, from political science to software development. However, these models are constrained by their training data, which is static and limited to information available up to a specific date...

CVE-2025-59363

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

TPSQLi: Test Prioritization for SQL Injection Vulnerability Detection in Web Applications

The rapid proliferation of network applications has led to a significant increase in network attacks. According to the OWASP Top 10 Projects report released in 2021, injection attacks rank among the top three vulnerabilities in software projects. This growing threat landscape has increased the...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a vulnerability that could provide weaker than expected security due to crypto.js (CVE-2020-36732)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a vulnerability in the crypto.js library with the openidConnectServer-1.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage

The security landscape for cloud-native applications is undergoing a profound transformation. Containers, Kubernetes, and serverless technologies are now the default for modern enterprises, accelerating delivery but also expanding the attack surface in ways traditional security models can't keep ...

Side-Channel Inference of User Activities in AR/VR Using GPU Profiling

Over the past decade, AR/VR devices have drastically changed how we interact with the digital world. Users often share sensitive information, such as their location, browsing history, and even financial data, within third-party apps installed on these devices, assuming a secure environment...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung mobile applications. A security vulnerability exists in SAMSUNG SMR, which stems from the presence of an out-of-bounds write that could lead to the execution of arbitrary code...

Boost the Performance and Security — and Lower the Costs — of AI Apps

...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle April 2025 Critical Patch Update. Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote attacker to cause high confidentiality...

EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2025-2103)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages...

Linux Distros Unpatched Vulnerability : CVE-2016-4762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary...

Monai: Unsafe use of Pickle deserialization may lead to RCE

To prevent this report from being deemed inapplicable or out of scope, due to the project's unique nature for medical applications and widespread popularity 6k+ stars, it's important to pay attention to some of the project's inherent security issues. This is because medical professionals may not...

Aspect-Oriented Programming in Secure Software Development: a Case Study of Security Aspects in Web Applications

Security remains a critical challenge in modern web applications, where threats such as unauthorized access, data breaches, and injection attacks continue to undermine trust and reliability. Traditional Object-Oriented Programming OOP often intertwines security logic with business functionality,...

CVE-2025-36855: Buffer Over-read

A vulnerability CVE-2025-21176 https://www.cve.org/CVERecord exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or...

XSSVulnerabilityScanner

It is an offensive tool for web application security testing. Th...

CVE-2025-26425

In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local escalation of privilege on versions of Android where android.permission.MANAGEDEFAULTAPPLICATIONS was not defined with no additional executi...

CVE-2025-26425

In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local escalation of privilege on versions of Android where android.permission.MANAGEDEFAULTAPPLICATIONS was not defined with no additional executi...

CVE-2025-26425

A logic error in multiple functions of RoleService.java in Android causes a permission squatting vulnerability. This can lead to local elevation of privilege on versions where android.permission.MANAGE_DEFAULT_APPLICATIONS was not defined. Exploitation does not require user interaction. The issue...