CVE-2025-48015 Observable Response Discrepancy

Failed login response could be different depending on whether the username was local or central...

IBM Security ReaQta EDR 信任管理问题漏洞

IBM Security ReaQta EDR is an Endpoint Detection and Response EDR solution from International Business Machines IBM that detects, investigates and responds to endpoint threats in real time through behavioral analytics and AI technologies, providing automated threat hunting and incident response...

AudioJailbreak: Jailbreak Attacks against End-To-End Large Audio-Language Models

Jailbreak attacks to Large audio-language models LALMs are studied recently, but they achieve suboptimal effectiveness, applicability, and practicability, particularly, assuming that the adversary can fully manipulate user prompts. In this work, we first conduct an extensive experiment showing th...

[ASA-202505-13] varnish: content spoofing

Arch Linux Security Advisory ASA-202505-13 ========================================== Severity: High Date : 2025-05-20 CVE-ID : CVE-2025-47905 Package : varnish Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-2879 Summary ======= The package varnish before version...

samlify SAML Signature Wrapping attack

A Signature Wrapping attack has been found in samlify v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider...

GHSA-R683-V43C-6XQV samlify SAML Signature Wrapping attack

A Signature Wrapping attack has been found in samlify v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider...

CVE-2025-47949

Summary: samlify (Node.js SAML library) has a Signature Wrapping vulnerability in versions prior to 2.10.0, enabling an attacker to forge a SAML Response to impersonate any user. An attacker would need a signed XML document from the identity provider. Fix/mitigation: Upgrade to version 2.10.0 or ...

Astra Linux - уязвимость в firefox, thunderbird

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first This vulnerability affects Firefox for iOS 136...

ABB Cylon FLXeon 9.3.5 (siteGuide.js) Authenticated Root Remote Code Execution

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

samlify 数据伪造问题漏洞

samlify is a Node.js library for SAML SSO by tngan individual developer. A data forgery issue vulnerability exists in samlify versions prior to 2.10.0, which stems from a signature wrapping attack that could lead to a forged SAML response...

Towards Centralized Orchestration of Cyber Protection Condition (CPCON)

The United States Cyber Command USCYBERCOM Cyber Protection Condition CPCON framework mandates graduated security postures across Department of Defense DoD networks, but current implementation remains largely manual, inconsistent, and error-prone. This paper presents a prototype system for...

[Webinar] From Code to Cloud to SOC: Learn a Smarter Way to Defend Modern Applications

Modern apps move fast—faster than most security teams can keep up. As businesses rush to build in the cloud, security often lags behind. Teams scan code in isolation, react late to cloud threats, and monitor SOC alerts only after damage is done. Attackers don't wait. They exploit vulnerabilities...

PT-2025-21778 · Unknown · Rsi Queue Management System

Name of the Vulnerable Software and Affected Versions: RSI Queue Management System version 3.0 Description: An unauthenticated blind SQL injection issue exists within the TaskID parameter of the GET request handler. This allows attackers to remotely inject time-delayed SQL payloads, inducing serv...

CLSA-2025-1747430870 cups-filters: Fix of 2 CVEs

CVE-2024-47175: prevent PPD generation based on invalid IPP response - CVE-2024-47850: do not generate PPD for remote raw queues and add system-cups.slice...

Security Bulletin: Vulnerabilities in Pivota Spring Framework, VMware Tanzu Spring Framework, VMware Spring Framework might affect IBM Storage Defender Copy Data Management.

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Pivota Spring Framework, VMware Tanzu Spring Framework, VMware Spring Framework. Vulnerabilities include an attacker and remote attacker could exploit these vulnerabilities to execute arbitrary code on the...

CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

CVE-2025-32287

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through = 3.5.7...

Azure Linux 3.0 Security Update: httpd / mod_http2 (CVE-2022-37436)

The version of httpd / modhttp2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-37436 advisory. - Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be...

GHSA-8JHR-WPCM-HH4H label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

Summary The vulnerability allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, unauthorized actions on behalf of the user, and other attacks. Details The vulnerability is reproducible when sending a properly formatted request to the POST...

AC-LoRA: (Almost) Training-Free Access Control-Aware Multi-Modal LLMs

Corporate LLMs are gaining traction for efficient knowledge dissemination and management within organizations. However, as current LLMs are vulnerable to leaking sensitive information, it has proven difficult to apply them in settings where strict access control is necessary. To this end, we desi...