Modeling Behavioral Preferences of Cyber Adversaries Using Inverse Reinforcement Learning

This paper presents a holistic approach to attacker preference modeling from system-level audit logs using inverse reinforcement learning IRL. Adversary modeling is an important capability in cybersecurity that lets defenders characterize behaviors of potential attackers, which enables attributio...

Security Bulletin: A vulnerability in IBM Spectrum Scale could allow a local attacker to bypass the filesystem audit logging (CVE-2021-29671)

Summary A security vulnerability has been identified in IBM Spectrum Scale FAL that could allow a local attacker to bypass the FAL mechanism. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2021-29671 DESCRIPTION: IBM Spectrum Scale could allow a local attacker to bypas...

Faraday 5.13.0

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

Introducing Qualys Policy Audit, the New Standard for Audit Readiness

Do you know how audit ready you really are? What if you could answer that question with confidence—at any moment, across every system, for every framework that matters to your business? In today’s rapidly shifting regulatory landscape, audits are no longer a periodic event—they’re a continuous...

Citrix Cloud VDIs hosted in Azure by Citrix Cloud shut down constantly with user sessions

When creating VDIs from a Master image that are rolled out with MCS into a Azure subscription - Users machines are constantly shutting down - Even when users are logged onto the machines, they consistently get shutdown after several minutes it can vary between 3-5 | 25-30 -The user will see a...

The vulnerability of the component “koko” in the security audit system for the operation and maintenance of JumpServer, which allows a perpetrator to obtain a cluster token from Kubernetes.

The vulnerability of the koko component in the system for auditing security operations and maintenance of JumpServer is related to improper privilege assignment. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain a Kubernetes cluster token...

CVE-2025-22110

CVE-2025-22110 affects the Linux kernel nfnetlink_queue path under netfilter. The vulnerability arises because a local message buffer ctx (lsmctx) could be read/used before proper initialization in nfqnl_build_packet_message(), since initialization occurs only after nfqnl_get_sk_secctx(). The pat...

Oracle VirtualBox Security Update (Apr 2025) - Windows

Oracle VirtualBox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:vmvirtualbox";...

Remote Code Execution (RCE)

generator-jhipster-entity-audit is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe reflection caused by using Javers as the Entity Audit Framework, which allows malicious classes on the classpath to be exploited through exposed REST endpoints...

PT-2025-16176 · Undefined · Undefined

Security audit of PHP https://t.co/Tl4FK62NVP 2 high, 6 medium, 9 low severity, and 10 informative issues. 4 CVEs, 3 of them public and fixed last year, 1 not yet fully public: CVE-2024-8928: Memory-related vulnerability in PHP's filter handling, leading to segmentation faults...

GHSA-PG9F-39PC-QF8G vulnerabilities

Vulnerabilities for packages: starship, fd, yazi, zed, nushell, wasmcloud, cargo-audit, oranda, ruff, pixi, rust-analyzer, yara-x, deno, cargo-c, oxipng, wadm, samply, lychee...

GHSA-PG9F-39PC-QF8G vulnerabilities

Vulnerabilities for packages: zed, starship, pixi, yara-x, deno, lychee, oranda, samply, wadm, cargo-c, fd, ztunnel, ruff, oxipng, wasmcloud, yazi, ztunnel-fips, cargo-audit, nushell, rust-analyzer...

SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

PT-2025-16150 · Crates.Io · Surrealdb

SurrealDB allows authenticated users with OWNER or EDITOR permissions at the root, database or namespace levels to define their own database functions using the DEFINE FUNCTION statement A custom database function comprises a name together with a function body. In the function body, the user...

April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band

None None...

April 11, 2025—KB5058921 (OS Build 14393.7973) Out-of-band

None None...

April 11, 2025—KB5058920 (OS Build 20348.3561) Out-of-band

None None...

April 11, 2025—KB5058919 (OS Builds 22621.5192 and 22631.5192) Out-of-band

None None...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

📄 Microsoft SQL Server 2022 Missing Log Entry

Microsoft SQL Server 2022 fails to properly log when a security audit is configured for SERVERPERMISSIONCHANGEGROUP. Title: SQL Server 2022 Security Audit Failure Vulnerability Product: Microsoft SQL Server Affected Versions: 2022 RTM-CU18 KB5050771 Tested Versions: 2022 RTM-CU18 KB5050771 Fix:...