Membership Inference Attacks on Sequence Models

Sequence models, such as Large Language Models LLMs and autoregressive image generators, have a tendency to memorize and inadvertently leak sensitive information. While this tendency has critical legal implications, existing tools are insufficient to audit the resulting risks. We hypothesize that...

UBUNTU-CVE-2025-0620

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again...

Privacy Leaks by Adversaries: Adversarial Iterations for Membership Inference Attack

Membership inference attack MIA has become one of the most widely used and effective methods for evaluating the privacy risks of machine learning models. These attacks aim to determine whether a specific sample is part of the model's training set by analyzing the model's output. While traditional...

Samba Missing Re-Authentication Vulnerability (CVE-2025-0620)

Samba is prone to a vulnerability when re-authenticating an expired SMB session. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-23682

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.21.6 Description The issue concerns a problem with SMB session re-authentication when using Kerberos authentication with SMB. Specifically, smbd does not pick up group membership changes when re-authenticating an...

CSVAR: Enhancing Visual Privacy in Federated Learning Via Adaptive Shuffling against Overfitting

Although federated learning preserves training data within local privacy domains, the aggregated model parameters may still reveal private characteristics. This vulnerability stems from clients' limited training data, which predisposes models to overfitting. Such overfitting enables models to...

Unlearning Inversion Attacks for Graph Neural Networks

Graph unlearning methods aim to efficiently remove the impact of sensitive data from trained GNNs without full retraining, assuming that deleted information cannot be recovered. In this work, we challenge this assumption by introducing the graph unlearning inversion attack: given only black-box...

Bayesian Perspective on Memorization and Reconstruction

We introduce a new Bayesian perspective on the concept of data reconstruction, and leverage this viewpoint to propose a new security definition that, in certain settings, provably prevents reconstruction attacks. We use our paradigm to shed new light on one of the most notorious attacks in the...

Discourse Policy 信息泄露漏洞

Discourse Policy is an open source plugin for Discourse that confirms that a user has seen or done something by alerting them. An information disclosure vulnerability exists in versions prior to Discourse Policy 0.1.1 that stems from not properly handling private group policies, which could lead ...

Practical Bayes-Optimal Membership Inference Attacks

We develop practical and theoretically grounded membership inference attacks MIAs against both independent and identically distributed i.i.d. data and graph-structured data. Building on the Bayesian decision-theoretic framework of Sablayrolles et al., we derive the Bayes-optimal membership...

TensorShield: Safeguarding On-Device Inference by Shielding Critical DNN Tensors with TEE

To safeguard user data privacy, on-device inference has emerged as a prominent paradigm on mobile and Internet of Things IoT devices. This paradigm involves deploying a model provided by a third party on local devices to perform inference tasks. However, it exposes the private model to two primar...

Unveiling Impact of Frequency Components on Membership Inference Attacks for Diffusion Models

Diffusion models have achieved tremendous success in image generation, but they also raise significant concerns regarding privacy and copyright issues. Membership Inference Attacks MIAs are designed to ascertain whether specific data were utilized during a model's training phase. As current MIAs...

Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models

State-of-the-art membership inference attacks MIAs typically require training many reference models, making it difficult to scale these attacks to large pre-trained language models LLMs. As a result, prior research has either relied on weaker attacks that avoid training reference models e.g.,...

CVE-2024-47354

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through = 1.6...

CVE-2024-46472

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page...

CVE-2024-46470

Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membershiptype field in the edit-type.php component...

CVE-2024-46471

The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information...

CVE-2024-48709

CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting XSS via the membershipType parameter in edittype.php...

CVE-2024-45528

CodeAstro MembershipM-PHP aka Membership Management System in PHP 1.0 allows addmembers.php fullname stored XSS...

CVE-2024-1535

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.15.2 due to insufficient input sanitizati...