Car Rental Portal Cross-Site Request Forgery Vulnerability

Car Rental Portal is a rental car portal. Car Rental Portal suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. The vulnerability can be exploited by an attacker to spoof a...

School Fees Payment System Cross-Site Request Forgery Vulnerability

School Fees Payment System is a tuition payment system. School Fees Payment System is vulnerable to a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. No details of the vulnerability are...

CVE-2025-49592 n8n Login Flow has Open Redirect Vulnerability

n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may...

AI and collaboration tools: how cyberattackers are targeting SMBs in 2025

Cyberattackers often view small and medium-sized businesses SMBs as easier targets, assuming their security measures are less robust than those of larger enterprises. In fact, attacks through contractors, also known as trusted relationship attacks, remain one of the top three methods used to brea...

Design High-Confidence Computers Using Trusted Instructional Set Architecture and Emulators

High-confidence computing relies on trusted instructional set architecture, sealed kernels, and secure operating systems. Cloud computing depends on trusted systems for virtualization tasks. Branch predictions and pipelines are essential in improving performance of a CPU/GPU. But Spectre and...

Privacy-Preserving Federated Learning against Malicious Clients Based on Verifiable Functional Encryption

Federated learning is a promising distributed learning paradigm that enables collaborative model training without exposing local client data, thereby protect data privacy. However, it also brings new threats and challenges. The advancement of model inversion attacks has rendered the plaintext...

Bidirectional Biometric Authentication Using Transciphering and (T)FHE

Biometric authentication systems pose privacy risks, as leaked templates such as iris or fingerprints can lead to security breaches. Fully Homomorphic Encryption FHE enables secure encrypted evaluation, but its deployment is hindered by large ciphertexts, high key overhead, and limited trust...

Building Automotive Security on Internet Standards: an Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services

The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become...

PT-2025-26322 · Coros · Coros Pace 3

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that allows the COROS Pace 3 to download firmware files via HTTP when connected to a WLAN, but the communication is not encrypted. This lack of encryption enables...

WordPress plugin Bluff Post 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Bluff Post plugin that stems from the WEB application not adequately verifying that a request is from a truste...

Uncover LOTS Attacks Hiding in Trusted Tools — Learn How in This Free Expert Session

Most cyberattacks today don't start with loud alarms or broken firewalls. They start quietly—inside tools and websites your business already trusts. It's called "Living Off Trusted Sites" LOTS—and it's the new favorite strategy of modern attackers. Instead of breaking in, they blend in. Hackers a...

CVE-2024-54183 IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentiall...

Astra Linux – Vulnerability in containerd-app

Containerd is an open-source container runtime. A bug was discovered in Containerd prior to versions 1.6.38, 1.7.27, and 2.0.4. In these versions, containers launched with a User set as UID:GID that exceeded the maximum 32-bit signed integer could cause an overflow condition, resulting in the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KEYS: Trusted: dcp: Fix improper use of sg with CONFIGVMAPSTACK=y When CONFIGVMAPSTACK=y is enabled, DCP-trusted keys may crash during the encoding and decryption of the blob encryption key via the DCP crypto driver. This issue...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tpm: Do not start the chip while it is suspended. Checking TPMCHIPFLAGSUSPENSED after the call to tpmfindgetops can lead to a spurious tpmchipstart call: 35985.503771 i2c i2c-1: Transfer while suspended 35985.503796 WARNING: CPU:...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop The OP-TEE supplicant is a user-space daemon, and it is possible for it to be hung, crashed, or terminated mid-processing an OP-TEE RPC call. This issue becomes more complex when there is...

CyFence: Securing Cyber-Physical Controllers Via Trusted Execution Environment

In the last decades, Cyber-physical Systems CPSs have experienced a significant technological evolution and increased connectivity, at the cost of greater exposure to cyber-attacks. Since many CPS are used in safety-critical systems, such attacks entail high risks and potential safety harms...

EulerOS 2.0 SP12 : containerd (EulerOS-SA-2025-1579)

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers...

Amazon Linux 2 : ecs-init (ALASECS-2025-067)

The version of ecs-init installed on the remote host is prior to 1.93.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-067 advisory. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where...

EulerOS 2.0 SP12 : containerd (EulerOS-SA-2025-1580)

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers...