Navigating the Deep: Signature Extraction on Deep Neural Networks

Neural network model extraction has emerged in recent years as an important security concern, as adversaries attempt to recover a network's parameters via black-box queries. A key step in this process is signature extraction, which aims to recover the absolute values of the network's weights laye...

The vulnerability of the Apache OFBiz resource planning software lies in the lack of adequate protection measures for web page structures, allowing attackers to carry out XSS attacks.

The vulnerability of Apache OFBiz’s resource planning software is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the formSafeEmailFilter() function in the Tenda FH451 router software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSafeEmailFilter function in the Tenda FH451 router software lies in the lack of data cleaning measures at the management level when processing the page parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures...

The vulnerability of the DataHandler class in the TYPO3 content management system allows attackers to enhance their privileges and gain unauthorized access to protected information.

The vulnerability of the DataHandler class in the TYPO3 content management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges and gain unauthorized access to protected information...

CVE-2023-28829

A vulnerability has been identified in SIMATIC NET PC Software V14 All versions, SIMATIC NET PC Software V15 All versions, SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions, SIMATIC WinCC All versions V8.0, SINAUT Software ST7sc All versions. Before...

CVE-2023-3441

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches...

The vulnerability of the setWiFiEasyCfg/setWiFiEasyGuestCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A3700R wireless router software allows a attacker to escalate their privileges.

The vulnerability of the setWiFiEasyCfg/setWiFiEasyGuestCfg function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A3700R wireless router software is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Zoo Management System /admin/profile.php File SQL Injection Vulnerability

Zoo Management System is a zoo management system. Zoo Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter contactnumber in the file /admin/profile.php. An attacker can exploit this...

The vulnerability of the Share Livestream module in the UniFi Protect video surveillance system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Share Livestream module in the UniFi Protect video surveillance system is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the sub_16570 function in the /htdocs/ssdpcgi file of the D-Link DIR-880L router’s microprogramming system, related to the lack of data cleaning at the control level, allows a hacker to execute arbitrary commands.

The vulnerability of the sub16570 function in the /htdocs/ssdpcgi file of the D-Link DIR-880 router’s microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of the ColdFusion software platform, related to deficiencies in the authentication mechanism, allows attackers to circumvent existing security restrictions and execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code...

The vulnerability of software for integrating old and new technologies from IBM EntireX, related to deficiencies in the error reporting mechanism, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the software for integrating old and new IBM EntireX technologies is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

The vulnerability of the iControl REST component of the access control and remote authentication solution for BIG-IP allows a perpetrator to inject arbitrary commands.

The vulnerability of the iControl REST component of the access control and remote authentication solution for BIG-IP is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands remotely...

TOTOLINK CPE CP900 安全漏洞

TOTOLINK CPE CP900 is an outdoor wireless CPE device from China Gion Electronics TOTOLINK. The TOTOLINK CPE CP900 suffers from a command injection vulnerability that stems from the setUploadUserData function failing to properly filter construct command special characters, commands, etc. No detail...

The vulnerability of the virtual learning environment web service Moodle allows a perpetrator to gain unauthorized access to user data.

The vulnerability of the Moodle virtual learning environment’s web service is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to user data...

The vulnerability of the Multi-Factor Authentication component in the virtual learning environment Moodle allows a perpetrator to gain unauthorized access to protected information or execute arbitrary codes.

The vulnerability of the Multi-Factor Authentication component in the virtual learning environment Moodle is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information or execute arbitrary...

The vulnerability of the SAP Solution Manager platform, related to deficiencies in the authentication process, allows a perpetrator to compromise the confidentiality of protected information.

The vulnerability of the SAP Solution Manager platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to compromise the confidentiality of the protected information...

The vulnerability of the web interface of the microprogramming software for routers EDIMAX BR-6478AC allows a hacker to elevate their privileges and execute arbitrary commands.

The vulnerability of the web interface of the microprogrammed software router EDIMAX BR-6478AC is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and execute arbitrary commands...

WordPress plugin OTP-less one tap Sign in 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

The vulnerability of the Microsoft Visual Studio software development tool, related to access control deficiencies, allows attackers to escalate their privileges.

The vulnerability of the Microsoft Visual Studio software development tool is related to lack of access control. Exploiting this vulnerability can allow attackers to enhance their privileges...