4008 matches found
CVE-2021-21982
VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful...
CVE-2018-1000191
A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anoth...
CVE-2018-19459
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file...
CVE-2015-1564
Cross-site scripting XSS vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field...
CVE-2018-1000197
An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration...
CVE-2011-3865
Cross-site scripting XSS vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php...
CVE-2012-4389
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file...
CAIN: Hijacking LLM-Humans Conversations Via a Two-Stage Malicious System Prompt Generation and Refining Framework
Large language models LLMs have advanced many applications, but are also known to be vulnerable to adversarial attacks. In this work, we introduce a novel security threat: hijacking AI-human conversations by manipulating LLMs' system prompts to produce malicious answers only to specific targeted...
CVE-2008-0940
Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407...
JULI: Jailbreak Large Language Models by Self-Introspection
Large Language Models LLMs are trained with safety alignment to prevent generating malicious content. Although some attacks have highlighted vulnerabilities in these safety-aligned LLMs, they typically have limitations, such as necessitating access to the model weights or the generation process...
Beyond Text: Unveiling Privacy Vulnerabilities in Multi-Modal Retrieval-Augmented Generation
Multimodal Retrieval-Augmented Generation MRAG systems enhance LMMs by integrating external multimodal databases, but introduce unexplored privacy vulnerabilities. While text-based RAG privacy risks have been studied, multimodal data presents unique challenges. We provide the first systematic...
Traceable Black-Box Watermarks for Federated Learning
Whitepaper called Traceable Black-Box Watermarks For Federated Learning...
AutoPentest: Enhancing Vulnerability Management with Autonomous LLM Agents
A recent area of increasing research is the use of Large Language Models LLMs in penetration testing, which promises to reduce costs and thus allow for higher frequency. We conduct a review of related work, identifying best practices and common evaluation issues. We then present AutoPentest, an...
The Internet’s Biggest-Ever Black Market Just Shut Down Amid a Telegram Purge
Following a WIRED inquiry, Telegram banned thousands of accounts used for crypto-scam money laundering, including those of Haowang Guarantee, a black market that enabled over $27 billion in transactions...
Adversarial Suffix Filtering: a Defense Pipeline for LLMs
Large Language Models LLMs are increasingly embedded in autonomous systems and public-facing environments, yet they remain susceptible to jailbreak vulnerabilities that may undermine their security and trustworthiness. Adversarial suffixes are considered to be the current state-of-the-art...
Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores
The advent of convenient and efficient fully unmanned stores equipped with artificial intelligence-based automated checkout systems marks a new era in retail. However, these systems have inherent artificial intelligence security vulnerabilities, which are exploited via adversarial patch attacks,...
Fresh User layers hang/freeze on first logon
When logging on with a fresh profile/ user layer, the UL is created but logon process comes to a halt at a black screen force log off and log back fix the issue, the session is established and user desktop is shown...
DP-TRAE: a Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection
In the field of digital security, Reversible Adversarial Examples RAE combine adversarial attacks with reversible data hiding techniques to effectively protect sensitive data and prevent unauthorized analysis by malicious Deep Neural Networks DNNs. However, existing RAE techniques primarily focus...
POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
Large language models LLMs have achieved remarkable success in various domains, primarily due to their strong capabilities in reasoning and generating human-like text. Despite their impressive performance, LLMs are susceptible to hallucinations, which can lead to incorrect or misleading outputs...