12458 matches found
Efficient Unlearning with Privacy Guarantees
Privacy protection laws, such as the GDPR, grant individuals the right to request the forgetting of their personal data not only from databases but also from machine learning ML models trained on them. Machine unlearning has emerged as a practical means to facilitate model forgetting of data...
The vulnerability of the Vagrant framework for creating and managing development environments lies in its ability to allow a hacker to download and edit the Vagrantfile file on the host virtual machine. This enables the hacker to read and modify data, as well as execute arbitrary code.
The vulnerability of the Vagrant framework for creating and managing development environments lies in the ability to load and edit the Vagrantfile file on the host virtual machine, due to the use of a default synchronized folder configuration. Exploiting this vulnerability can allow an attacker t...
Extreme Learning Machine Based System for DDoS Attacks Detections on IoMT Devices
The Internet of Medical Things IoMT represents a paradigm shift in the healthcare sector, enabling the interconnection of medical devices, sensors, and systems to enhance patient monitoring, diagnosis, and management. The rapid evolution of IoMT presents significant benefits to the healthcare...
IThermTroj: Exploiting Intermittent Thermal Trojans in Multi-Processor System-On-Chips
Thermal Trojan attacks present a pressing concern for the security and reliability of System-on-Chips SoCs, especially in mobile applications. The situation becomes more complicated when such attacks are more evasive and operate sporadically to stay hidden from detection mechanisms. In this paper...
The vulnerability of the container management system and the virtual machine manager Incus, related to unlimited resource distribution, allows attackers to bypass security restrictions and cause service failures.
The vulnerability of the container management system and the virtual machine manager Incus is related to the unlimited distribution of resources due to incorrect generation of access control rules for local services based on an access control list. Exploiting this vulnerability can allow a...
The vulnerability of the Java VM component of the Oracle Database Server management system allows a hacker to gain access to read, modify, or delete data.
The vulnerability of the Java VM component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data remotely...
SoK: a Systematic Review of Context- and Behavior-Aware Adaptive Authentication in Mobile Environments
As mobile computing becomes central to digital interaction, researchers have turned their attention to adaptive authentication for its real-time, context- and behavior-aware verification capabilities. However, many implementations remain fragmented, inconsistently apply intelligent techniques, an...
Human-Centered Interactive Anonymization for Privacy-Preserving Machine Learning: a Case for Human-Guided K-Anonymity
Privacy-preserving machine learning ML seeks to balance data utility and privacy, especially as regulations like the GDPR mandate the anonymization of personal data for ML applications. Conventional anonymization approaches often reduce data utility due to indiscriminate generalization or...
ML-Enhanced AES Anomaly Detection for Real-Time Embedded Security
Advanced Encryption Standard AES is a widely adopted cryptographic algorithm, yet its practical implementations remain susceptible to side-channel and fault injection attacks. In this work, we propose a comprehensive framework that enhances AES-128 encryption security through controlled anomaly...
SUSE CVE-2025-34075
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Initially assigned to document an issues that allows guest VM to modify the host's Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does...
DEBIAN-CVE-2025-38102
In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify During our test, it is found that a warning can be trigger in trygrabfolio as follow: ------------ cut here ------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147...
AZL-64496 CVE-2025-38102 affecting package kernel for versions less than 6.6.96.1-1
In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify During our test, it is found that a warning can be trigger in trygrabfolio as follow: ------------ cut here ------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147...
Malicious code in comcastapp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31612a7938787ffe91079ad30056051f31a068066752a935bc2123267f409730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-HQP6-MJW3-F586 HashiCorp Vagrant has code injection vulnerability through default synced folders
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant or C:\vagrant on Windows. Thi...
HashiCorp Vagrant has code injection vulnerability through default synced folders
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant or C:\vagrant on Windows. Thi...
CVE-2025-34075
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Initially assigned to document an issues that allows guest VM to modify the host’s Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended...
CVE-2025-34075
CVE-2025-34075 entry is labeled rejected/withdrawn by the CNA. Connected docs describe a guest-to-host code-execution vector in HashiCorp Vagrant via the default synced-folder Vagrantfile exposure: Vagrant mounts the host project directory (including Vagrantfile) into the guest, and an attacker w...
Malicious code in reqweaver (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 186187a80deaba9e48696b9c33ee7d2c73224d43193dcbf3d70bcc8f43569c9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
podman: podman missing TLS verification
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...