173 matches found
MAL-2025-7833 Malicious code in @dvpe/3dconcepts-ui (npm)
The package @dvpe/3dconcepts-ui was found to contain malicious code...
Bridging the Gap in Vision Language Models in Identifying Unsafe Concepts across Modalities
Whitepaper called Bridging The Gap In Vision Language Models In Identifying Unsafe Concepts Across Modalities...
Do Concept Replacement Techniques Really Erase Unacceptable Concepts?
Generative models, particularly diffusion-based text-to-image T2I models, have demonstrated astounding success. However, aligning them to avoid generating content with unacceptable concepts e.g., offensive or copyrighted content, or celebrity likenesses remains a significant challenge. Concept...
One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIP
Deep Neural Networks DNNs have achieved widespread success yet remain prone to adversarial attacks. Typically, such attacks either involve frequent queries to the target model or rely on surrogate models closely mirroring the target model -- often trained with subsets of the target model's traini...
Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries
Retrieval-Augmented Generation RAG systems enhance large language models LLMs by incorporating external knowledge bases, but they are vulnerable to privacy risks from data extraction attacks. Existing extraction methods typically rely on malicious inputs such as prompt injection or jailbreaking,...
Blind Spot Navigation: Evolutionary Discovery of Sensitive Semantic Concepts for LVLMs
Whitepaper called Blind Spot Navigation: Evolutionary Discovery Of Sensitive Semantic Concepts For LVLMs...
DMind Benchmark: toward a Holistic Assessment of LLM Capabilities across the Web3 Domain
Large Language Models LLMs have achieved impressive performance in diverse natural language processing tasks, but specialized domains such as Web3 present new challenges and require more tailored evaluation. Despite the significant user base and capital flows in Web3, encompassing smart contracts...
CISA: Dams Sector Crisis Management Handbook
The Dams Sector Crisis Management Handbook 2025 introduces crisis management concepts, explains how crisis management measures are an important component of an overall risk management framework, and highlights guidelines to apply these concepts to dams and related infrastructure...
PatchFuzz: Patch Fuzzing for JavaScript Engines
Patch fuzzing is a technique aimed at identifying vulnerabilities that arise from newly patched code. While researchers have made efforts to apply patch fuzzing to testing JavaScript engines with considerable success, these efforts have been limited to using ordinary test cases or publicly...
Security Science (SecSci), Basic Concepts and Mathematical Foundations
This textbook compiles the lecture notes from security courses taught at Oxford in the 2000s, at Royal Holloway in the 2010s, and currently in Hawaii. The early chapters are suitable for a first course in security. The middle chapters have been used in advanced courses. Towards the end there are...
A Review on Privacy in DAG-Based DLTs
Directed Acyclic Graph DAG-based Distributed Ledger Technologies DLTs have emerged as a promising solution to the scalability issues inherent in traditional blockchains. However, amidst the focus on scalability, the crucial aspect of privacy within DAG-based DLTs has been largely overlooked. This...
Set You Straight: Auto-Steering Denoising Trajectories to Sidestep Unwanted Concepts
Ensuring the ethical deployment of text-to-image models requires effective techniques to prevent the generation of harmful or inappropriate content. While concept erasure methods offer a promising solution, existing finetuning-based approaches suffer from notable limitations. Anchor-free methods...
Concept Enhancement Engineering: a Lightweight and Efficient Robust Defense against Jailbreak Attacks in Embodied AI
Embodied Intelligence EI systems integrated with large language models LLMs face significant security risks, particularly from jailbreak attacks that manipulate models into generating harmful outputs or executing unsafe physical actions. Traditional defense strategies, such as input filtering and...
CVE-2025-24886
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users admin not required to perform an LFI from the CTFd container. When a user clones or updates repositories, a check...
CVE-2024-29773
Cross-Site Request Forgery CSRF vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint allows Cross-Site Scripting XSS.This issue affects BizPrint: from n/a through 4.5.5...
CVE-2024-32777
Missing Authorization vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint.This issue affects BizPrint: from n/a through 4.3.39...
CVE-2025-24886 pwn.college has Symlink LFI in Dojo repos
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users admin not required to perform an LFI from the CTFd container. When a user clones or updates repositories, a check...
CVE-2024-56027 WordPress Leads CRM plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bizswoop Leads CRM leads-crm allows Reflected XSS.This issue affects Leads CRM: from n/a through = 2.0.13...
