SEC-Bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks

Rigorous security-focused evaluation of large language model LLM agents is imperative for establishing trust in their safe deployment throughout the software development lifecycle. However, existing benchmarks largely rely on synthetic challenges or simplified vulnerability datasets that fail to...

AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions

The rapid advancement of vision-language models VLMs and their integration into embodied agents have unlocked powerful capabilities for decision-making. However, as these systems are increasingly deployed in real-world environments, they face mounting safety concerns, particularly when responding...

Benchmarking Misuse Mitigation against Covert Adversaries

Existing language model safety evaluations focus on overt attacks and low-stakes tasks. Realistic attackers can subvert current safeguards by requesting help on small, benign-seeming tasks across many independent queries. Because individual queries do not appear harmful, the attack is hard to...

From past to Present: a Survey of Malicious URL Detection Techniques, Datasets and Code Repositories

Malicious URLs persistently threaten the cybersecurity ecosystem, by either deceiving users into divulging private data or distributing harmful payloads to infiltrate host systems. Gaining timely insights into the current state of this ongoing battle holds significant importance. However, existin...

ABAC Lab: an Interactive Platform for Attribute-Based Access Control Policy Analysis, Tools, and Datasets

Attribute-Based Access Control ABAC provides expressiveness and flexibility, making it a compelling model for enforcing fine-grained access control policies. To facilitate the transition to ABAC, extensive research has been conducted to develop methodologies, frameworks, and tools that assist...

Malicious code in jcp-benchmarking (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b0e185faf71a47d06bf407e04233da78db300929cea4486b8c8df41edbc6c67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ThreMoLIA: Threat Modeling of Large Language Model-Integrated Applications

Large Language Models LLMs are currently being integrated into industrial software applications to help users perform more complex tasks in less time. However, these LLM-Integrated Applications LIA expand the attack surface and introduce new kinds of threats. Threat modeling is commonly used to...

Revisiting Data Auditing in Large Vision-Language Models

With the surge of large language models LLMs, Large Vision-Language Models VLMs--which integrate vision encoders with LLMs for accurate visual grounding--have shown great potential in tasks like generalist agents and robotic control. However, VLMs are typically trained on massive web-scraped...

Benchmarking Differentially Private Tabular Data Synthesis

Differentially private DP tabular data synthesis generates artificial data that preserves the statistical properties of private data while safeguarding individual privacy. The emergence of diverse algorithms in recent years has introduced challenges in practical applications, such as inconsistent...

androidx.benchmark:benchmark-common (>=1.1.0 <=1.4.0-alpha07), androidx.benchmark:benchmark-junit4 (>=1.1.0 <=1.2.4) +432 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (>=1.0.0 <=5.1.0)

com.squareup.wire:wire-runtime MAVEN version =1.0.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.1.4-20211109.2053-a41370d, =0.1.0, =0.1.4-20211109.2053-a41370d, =0.1.4-20211109.2053-a41370d, =0.1.4-20220406.2256-c2ad520, =0.1.4-20211109.2053-a41370d, =0.1.0, =0.1.3-20210127.1838-76ab4fc,...

On Generative AI Security

Microsoft's AI Red Team just published "Lessons from Red Teaming 100 Generative AI Products." Their blog post lists "three takeaways," but the eight lessons in the report itself are more useful: 1. Understand what the system can do and where it is applied. 2. You don't have to compute gradients t...

dma-mapping: benchmark: handle NUMA_NO_NODE correctly

...

CloudBridge 4000 and 5000 to Optimize NetApp SnapMirror Traffic1

This article describes how you can configure Citrix CloudBridge 4000 and 5000 to optimize NetApp SnapMirror traffic between two Data centers. The article also provides the benchmarking results from lab testing efforts to quantify the gains that can be attained by deploying NetApp SnapMirror...

Fedora: Security Advisory for rust-hyperfine (FEDORA-2024-40ee18b2e7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: rust-hyperfine-1.18.0-3.fc39

A command-line benchmarking tool...

Fedora: Security Advisory for rust-hyperfine (FEDORA-2024-ce2936b568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: rust-hyperfine-1.18.0-3.fc40

A command-line benchmarking tool...

iPerf3 before 3.17 when used with OpenSSL before 3.2.0 as a server with RSA authentication allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

...

MP-SPDZ 安全漏洞

MP-SPDZ is a CSIRO Data61 Engineering & Design open source software for benchmarking various Secure Multiparty Computing MPC protocols in various security models. A security vulnerability exists in MP-SPDZ version v0.3.8. An attacker exploited the vulnerability to cause a denial of service on the...

ChatGPT Can Vastly Improve Healthcare, But The Industry Needs A Secure Database First

By Waqas ChatGPT’s capabilities have been put to the test in numerous ways, and it has successfully passed no less than four U.S. benchmarking examinations for physicians. This is a post from HackRead.com Read the original post: ChatGPT Can Vastly Improve Healthcare, But The Industry Needs A Secu...