PT-2025-24278 · Kunbus · Revolution Pi Webstatus +1

Name of the Vulnerable Software and Affected Versions: RevPi Webstatus versions prior to v2.4.6 Description: An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion, leading to full compromise of the device. The root...

Safety Analysis in the NGAC Model

We study the safety problem for the next-generation access control NGAC model. We show that under mild assumptions it is coNP-complete, and under further realistic assumptions we give an algorithm for the safety problem that significantly outperforms naive brute force search. We also show that...

Privacy-Preserving Transformers: SwiftKey'S Differential Privacy Implementation

In this paper we train a transformer using differential privacy DP for language modeling in SwiftKey. We run multiple experiments to balance the trade-off between the model size, run-time speed and accuracy. We show that we get small and consistent gains in the next-word-prediction and accuracy...

The vulnerability of the SureTriggers plugin of the WordPress content management system allows attackers to create administrator accounts on the website.

The vulnerability of the SureTriggers plugin of the WordPress content management system is related to insufficient comparison. Exploiting this vulnerability could allow a malicious actor to create administrator accounts on the website...

On the Prevalence and Usage of Commit Signing on GitHub: a Longitudinal and Cross-Domain Study

GitHub is one of the most widely used public code development platform. However, the code hosted publicly on the platform is vulnerable to commit spoofing that allows an adversary to introduce malicious code or commits into the repository by spoofing the commit metadata to indicate that the code...

Timing Attack

github.com/mattermost/mattermost-server is vulnerable to a Timing attack. The vulnerability is due to improper implementation of constant time comparison when comparing the MSTeams plugin webhook secret, allows an attacker to exploit timing differences in the comparison process to extract the...

Heavy-Tailed Privacy: the Symmetric Alpha-Stable Privacy Mechanism

With the rapid growth of digital platforms, there is increasing apprehension about how personal data is collected, stored, and used by various entities. These concerns arise from the increasing frequency of data breaches, cyber-attacks, and misuse of personal information for targeted advertising...

CVE-2024-13650: Improper Neutralization of Input During Web Page Generation

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for...

[SECURITY] Fedora 41 Update: perl-String-Compare-ConstantTime-0.321-21.fc41

This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string...

[SECURITY] Fedora 40 Update: perl-String-Compare-ConstantTime-0.321-19.fc40

This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string...

[SECURITY] Fedora 42 Update: perl-String-Compare-ConstantTime-0.321-22.fc42

This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string...

SoK: Security of EMV Contactless Payment Systems

The widespread adoption of EMV Europay, Mastercard, and Visa contactless payment systems has greatly improved convenience for both users and merchants. However, this growth has also exposed significant security challenges. This SoK provides a comprehensive analysis of security vulnerabilities in...

PT-2025-38571

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the wifi subsystem, specifically in the cfg80211 component, leading to a use-after-free condition in the cmp bss function. This issue was addresse...

Leveraging Vertical Public-Private Split for Improved Synthetic Data Generation

Differentially Private Synthetic Data Generation DP-SDG is a key enabler of private and secure tabular-data sharing, producing artificial data that carries through the underlying statistical properties of the input data. This typically involves adding carefully calibrated statistical noise to...

Measuring Computational Universality of Fully Homomorphic Encryption

Many real-world applications, such as machine learning and graph analytics, involve combinations of linear and non-linear operations. As these applications increasingly handle sensitive data, there is a significant demand for privacy-preserving computation techniques capable of efficiently...

CVE-2025-32464: Comparison Using Wrong Factors

HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sampleconvregsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one...

Aura or LifeLock: Who Offers Better Identity Protection in 2025?

The Growing Threat of Digital Identity Theft Identity theft is a continuous online threat that lurks behind every…...

CVE-2024-36469

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one...

DEBIAN-CVE-2024-13939

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...

CVE-2024-13939

The String::Compare::ConstantTime Perl module, specifically versions through 0.321 , is vulnerable to a timing attack within its equals function. Because the function returns false immediately when string lengths differ, an attacker can observe the time difference to guess the length of a secret ...