38930 matches found
Can Federated Learning Safeguard Private Data in LLM Training? Vulnerabilities, Attacks, and Defense Evaluation
Fine-tuning large language models LLMs with local data is a widely adopted approach for organizations seeking to adapt LLMs to their specific domains. Given the shared characteristics in data across different organizations, the idea of collaboratively fine-tuning an LLM using data from multiple...
Cryptographic Backdoor for Neural Networks: Boon and Bane
In this paper we show that cryptographic backdoors in a neural network NN can be highly effective in two directions, namely mounting the attacks as well as in presenting the defenses as well. On the attack side, a carefully planted cryptographic backdoor enables powerful and invisible attack on t...
SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist
Austin, Texas, USA, 23rd September 2025, CyberNewsWire...
TOTOLINK X6000R 安全漏洞
TOTOLINK X6000R is a wireless router supporting Wi-Fi 6 technology from China's Gion Electronics TOTOLINK, focusing on high concurrent connections and dual-band transmission capabilities. The TOTOLINK X6000R suffers from an improper input validation vulnerability, which can be exploited by...
AI-Powered App Exposes User Data, Creates Risk of Supply Chain Attacks
Trend™ Research’s analysis of Wondershare RepairIt reveals how the AI-driven app exposed sensitive user data due to unsecure cloud storage practices and hardcoded credentials, creating risks of model tampering and supply chain attacks...
Obelix: Mitigating Side-Channels through Dynamic Obfuscation
Trusted execution environments TEEs offer hardware-assisted means to protect code and data. However, as shown in numerous results over the years, attackers can use side-channels to leak data access patterns and even single-step the code. While the vendors are slowly introducing hardware-based...
WSO2 Identity Server 安全漏洞
WSO2 Identity Server IS is an identity server from WSO2, Inc. A security vulnerability exists in WSO2 Identity Server IS that stems from improper handling of error messages and could lead to malicious content injection and social engineering attacks...
UBUNTU-CVE-2025-59420
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters crit, violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical...
CVE-2025-59420
Authlib (Python) prior to 1.6.4 verifies JWS tokens with unknown critical header parameters (crit), violating RFC 7515 must-understand semantics. An attacker could craft a signed token that strict verifiers reject but Authlib accepts, enabling policy bypass, replay, or privilege escalation in mix...
Exploit for Missing Authorization in Elementor Website_Builder
Отчёт по учебной практике Содержание - 1. Введение1-в...
Weitong Mall 授权问题漏洞
Weitong Mall is a shopping mall system developed by fuyanglipengjun. Weitong Mall version 1.0 has an authorization issue vulnerability, the vulnerability stems from improper authorization of the TopicCategoryController function in the file /topiccategory/queryAll, which may lead to remote attacks...
PT-2025-39088
Name of the Vulnerable Software and Affected Versions fuyang lipengjun platform version 1.0 Description An improper authorization issue exists in the TopicCategoryController function within the /topiccategory/queryAll file of the fuyang lipengjun platform. This allows for remote attacks. The...
Weitong Mall 授权问题漏洞
Weitong Mall is a shopping mall system developed by fuyanglipengjun. Weitong Mall Weitong Mall 1.0 version of the authorization problem vulnerability, the vulnerability stems from the file /usercoupon/queryAll function UserCouponController authorization is not appropriate, which may lead to remot...
JimuReport 代码问题漏洞
JimuReport is a free reporting tool open source by JEECG in China. A code issue vulnerability exists in JimuReport 2.1.2 and earlier versions, which stems from a deserialization issue in file /drag/onlDragDataSource/testConnection in the MySQL JDBC Handler component, which could lead to remote...
CVE-2025-57452
In realme BackupRestore app v15.1.122810c08250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash and potential XSS via crafted ADB intents...
CVE-2025-59350
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time...
Inference Attacks on Encrypted Online Voting Via Traffic Analysis
Online voting enables individuals to participate in elections remotely, offering greater efficiency and accessibility in both governmental and organizational settings. As this method gains popularity, ensuring the security of online voting systems becomes increasingly vital, as the systems...
Future-Proofing Cloud Security against Quantum Attacks: Risk, Transition, and Mitigation Strategies
Quantum Computing QC introduces a transformative threat to digital security, with the potential to compromise widely deployed classical cryptographic systems. This survey offers a comprehensive and systematic examination of quantumsafe security for Cloud Computing CC, focusing on the...
SonicWall Urges Password Resets After Cloud Backup Breach Affecting Under 5% of Customers
SonicWall is urging customers to reset credentials after their firewall configuration backup files were exposed in a security breach impacting MySonicWall accounts. The company said it recently detected suspicious activity targeting the cloud backup service for firewalls, and that unknown threat...