New Cryptanalysis of the Fiat-Shamir Protocol

A couple of months ago, a new paper demonstrated some new attacks against the Fiat-Shamir transformation. Quanta published a good article that explains the results. This is a pretty exciting paper from a theoretical perspective, but I don't see it leading to any practical real-world cryptanalysis...

GHSA-P5JQ-5383-QVC7 TYPO3 CMS uses insufficient entropy when generating passwords

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

CVE-2025-59015

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

Windows SMB Elevation of Privilege Vulnerability

SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. The SMB Server already supports mechanisms for hardening against...

KB5065430: Windows 10 LTS 1507 Security Update (September 2025)

The remote Windows host is missing security update 5065430. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...

KB5065509: Windows Server 2012 Security Update (September 2025)

The remote Windows host is missing security update 5065509. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...

SAGE: Sample-Aware Guarding Engine for Robust Intrusion Detection against Adversarial Attacks

The rapid proliferation of the Internet of Things IoT continues to expose critical security vulnerabilities, necessitating the development of efficient and robust intrusion detection systems IDS. Machine learning-based intrusion detection systems ML-IDS have significantly improved threat detectio...

PT-2025-36691

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: A deterministic three-character prefix in the Password Generation component reduces entropy, potentially enabling attackers to expedite brute-for...

TYPO3 CMS 安全漏洞

TYPO3 CMS is a content management system from TYPO3 open source. A security vulnerability exists in TYPO3 CMS versions 12.4.36 and earlier and 13.4.17 and earlier, which stems from insufficient entropy in the password generation component and could lead to brute-force breaking attacks...

Backdoor Attacks and Defenses in Computer Vision Domain: a Survey

Backdoor trojan attacks embed hidden, controllable behaviors into machine-learning models so that models behave normally on benign inputs but produce attacker-chosen outputs when a trigger is present. This survey reviews the rapidly growing literature on backdoor attacks and defenses in the...

PT-2025-36891

Name of the Vulnerable Software and Affected Versions Windows Server Message Block SMB versions prior to September 2025 Patch Tuesday Description The SMB Server may be susceptible to relay attacks depending on the configuration. Successful exploitation of this issue could allow an attacker to...

KB5065510: Windows Server 2008 R2 Security Update (September 2025)

The remote Windows host is missing security update 5065510. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...

KB5065425: Windows Server version 23H2 Security Update (September 2025)

The remote Windows host is missing security update 5065425. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...

Element Plus 安全漏洞

Element Plus is an open source Vue.js 3 UI library from the China Element Plus organization. A security vulnerability exists in Element Plus 2.10.6 and earlier versions, which stems from insufficient input validation of the href attribute and could lead to cross-site scripting attacks and phishin...

KB5065427: Windows 10 Version 1607 / Windows Server 2016 Security Update (September 2025)

The remote Windows host is missing security update 5065427. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...

KB5065431: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (September 2025)

The remote Windows host is missing security update 5065431. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...

KB5065426: Windows 11 Version 24H2 / Windows Server 2025 Security Update (September 2025)

The remote Windows host is missing security update 5065426 or hotpatch 5065474. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform rela...

Zero-Day in Sitecore Exploited to Deploy WEEPSTEEL Malware

Hackers exploit a Sitecore zero-day CVE-2025-53690 to deploy WEEPSTEEL Malware via ViewState attacks, enabling Remote Code Execution RCE...

GO-2025-3917 NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector

NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?

Jailbreak attacks on Large Language Models LLMs have demonstrated various successful methods whereby attackers manipulate models into generating harmful responses that they are designed to avoid. Among these, Greedy Coordinate Gradient GCG has emerged as a general and effective approach that...