14320 matches found
MAL-2025-4043 Malicious code in fireblocks-netlink-v2-api-validator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ef9984660d27e961e84209123eecd25e75b39ff6c769c35e6c5a50c5a1781b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Optimal Client Sampling in Federated Learning with Client-Level Heterogeneous Differential Privacy
Federated Learning with client-level differential privacy DP provides a promising framework for collaboratively training models while rigorously protecting clients' privacy. However, classic approaches like DP-FedAvg struggle when clients have heterogeneous privacy requirements, as they must...
An Automated Blackbox Noncompliance Checker for QUIC Server Implementations
We develop QUICtester, an automated approach for uncovering non-compliant behaviors in the ratified QUIC protocol implementations RFC 9000/9001. QUICtester leverages active automata learning to abstract the behavior of a QUIC implementation into a finite state machine FSM representation. Unlike...
A Systematic Review and Taxonomy for Privacy Breach Classification: Trends, Gaps, and Future Directions
In response to the rising frequency and complexity of data breaches and evolving global privacy regulations, this study presents a comprehensive examination of academic literature on the classification of privacy breaches and violations between 2010-2024. Through a systematic literature review, a...
QUT-DV25: a Dataset for Dynamic Analysis of Next-Gen Software Supply Chain Attacks
Securing software supply chains is a growing challenge due to the inadequacy of existing datasets in capturing the complexity of next-gen attacks, such as multiphase malware execution, remote access activation, and dynamic payload generation. Existing datasets, which rely on metadata inspection a...
Malicious code in examples-formic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 074e879e97761583a22531a3d4f917977ac387e40c36bc5eb35e3f4b367db196 The OpenSSF Package Analysis project identified 'examples-formic' @ 100.0.2 npm as malicious. It is considered malicious because: - The package...
MAL-2025-3951 Malicious code in examples-formic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 074e879e97761583a22531a3d4f917977ac387e40c36bc5eb35e3f4b367db196 The OpenSSF Package Analysis project identified 'examples-formic' @ 100.0.2 npm as malicious. It is considered malicious because: - The package...
Iβm done preparing the slides for my talk about Vulristics at PHDays
I 'm done preparing the slides for my talk about Vulristics at PHDays. I'll be speaking on the last day of the festival - Saturday, May 24, at 16:00 in Popov Hall 25. If you're there at that time, I'd be glad to see you. If not - join online! I'll have an hour to dive into Vulristics, vulnerabili...
MAL-2025-3957 Malicious code in vscode-oja (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 222332856f685e334465b24346da36177ea57028e903aaf5c7b6fc845f1e601a The OpenSSF Package Analysis project identified 'vscode-oja' @ 100.0.2 npm as malicious. It is considered malicious because: - The package...
MAL-2025-3949 Malicious code in evo-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1963187cd4dc65fd86ae4bdae898bd2fea39e8e6a8464b3b00e2a83f5dcbb95b The OpenSSF Package Analysis project identified 'evo-web' @ 100.0.2 npm as malicious. It is considered malicious because: - The package executes...
An In-Kernel Forensics Engine for Investigating Evasive Attacks
Over the years, adversarial attempts against critical services have become more effective and sophisticated in launching low-profile attacks. This trend has always been concerning. However, an even more alarming trend is the increasing difficulty of collecting relevant evidence about these attack...
Malicious code in reload-nucleus-views-on-compile (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9b7dc180514fc1e38349d2d05cf314d0a6cd4de47cb4a7bd092edc29f24982b6 The OpenSSF Package Analysis project identified 'reload-nucleus-views-on-compile' @ 10.10.10 npm as malicious. It is considered malicious becaus...
MAL-2025-3929 Malicious code in apilogicserver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8beaeb43103672154062bf9b44734e305dad9ba1e9bbc6453d539cefa3e29f62 The OpenSSF Package Analysis project identified 'apilogicserver' @ 14.5.0 pypi as malicious. It is considered malicious because: - The package...
MalVis: a Large-Scale Image-Based Framework and Dataset for Advancing Android Malware Classification
As technology advances, Android malware continues to pose significant threats to devices and sensitive data. The open-source nature of the Android OS and the availability of its SDK contribute to this rapid growth. Traditional malware detection techniques, such as signature-based, static, and...
Coded Robust Aggregation for Distributed Learning under Byzantine Attacks
In this paper, we investigate the problem of distributed learning DL in the presence of Byzantine attacks. For this problem, various robust bounded aggregation RBA rules have been proposed at the central server to mitigate the impact of Byzantine attacks. However, current DL methods apply RBA rul...
MAL-2025-3865 Malicious code in mfe-react-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f7835d0f6b232544302030371ac74d4c595860a04736a2ef54259a32993f9c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress Magic Responsive Slider and Carousel WordPress plugin < 1.6 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Magic Responsive Slider and Carousel WordPress versions 1.6...
Forensics of Error Rates of Quantum Hardware
There has been a rise in third-party cloud providers offering quantum hardware as a service to improve performance at lower cost. Although these providers provide flexibility to the users to choose from several qubit technologies, quantum hardware, and coupling maps; the actual execution of the...
GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement
Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package dependency chain. These attacks are especially concerning for the Go language ecosystem, which is extensively...
On the Security Risks of ML-Based Malware Detection Systems: a Survey
Malware presents a persistent threat to user privacy and data integrity. To combat this, machine learning-based ML-based malware detection MD systems have been developed. However, these systems have increasingly been attacked in recent years, undermining their effectiveness in practice. While the...