SoK: Security of EMV Contactless Payment Systems

The widespread adoption of EMV Europay, Mastercard, and Visa contactless payment systems has greatly improved convenience for both users and merchants. However, this growth has also exposed significant security challenges. This SoK provides a comprehensive analysis of security vulnerabilities in...

PT-2025-38571

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the wifi subsystem, specifically in the cfg80211 component, leading to a use-after-free condition in the cmp bss function. This issue was addresse...

Leveraging Vertical Public-Private Split for Improved Synthetic Data Generation

Differentially Private Synthetic Data Generation DP-SDG is a key enabler of private and secure tabular-data sharing, producing artificial data that carries through the underlying statistical properties of the input data. This typically involves adding carefully calibrated statistical noise to...

Measuring Computational Universality of Fully Homomorphic Encryption

Many real-world applications, such as machine learning and graph analytics, involve combinations of linear and non-linear operations. As these applications increasingly handle sensitive data, there is a significant demand for privacy-preserving computation techniques capable of efficiently...

Aura or LifeLock: Who Offers Better Identity Protection in 2025?

The Growing Threat of Digital Identity Theft Identity theft is a continuous online threat that lurks behind every…...

CVE-2024-36469

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one...

DEBIAN-CVE-2024-13939

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...

CVE-2024-13939

The connected Astra Linux bulletin cites a timing-attack vulnerability in the Mojolicious Perl component (secure_compare) and notes only versions after 1.74 are affected, aligning with CVE-2024-13939’s class of timing leaks. Fedora/Nessus entries confirm CVE-2024-13939 is addressed by updates to ...

Ansible vs Terraform: Which is More Secure for Infrastructure Automation?

Gartner describes infrastructure as code IaC as a key way to unlock the potential of the cloud. However,…...

Timing attacks to guess password in lollms_authentication.py

Description The authenticateuser function in /server/endpoints/lollmsauthentication.py is vulnerable to timing attacks that can be exploited to: Enumerate valid usernames. Guess passwords incrementally by analyzing response time differences. Explanation of the vulnerability def...

The vulnerability of the microprogrammed software of industrial routers SCALANCE M-800 and industrial switches SCALANCE SC-600, related to partial comparison, allows a intruder to influence the integrity of the protected information.

The vulnerability of the microprogrammed software of industrial routers SCALANCE M-800 and industrial switches SCALANCE SC-600 is related to a partial comparison. Exploiting this vulnerability could allow an attacker operating remotely to influence the integrity of the protected information...

Post-Quantum Secure Feldman Verifiable Secret Sharing 安全漏洞

Post-Quantum Secure Feldman Verifiable Secret Sharing is a Verifiable Secret Sharing VSS for Post-Quantum Secure Feldman in Python by the individual developer David Osipov. A security vulnerability exists in Post-Quantum Secure Feldman Verifiable Secret Sharing 0.7.6b0 and earlier versions, which...

CVE-2025-0167 affecting package curl for versions less than 8.11.1-3

CVE-2025-0167 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

Linux Distros Unpatched Vulnerability : CVE-2012-2122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x...

Linux Distros Unpatched Vulnerability : CVE-2016-8616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existi...

CVE-2025-1571

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Image Comparison Widgets in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Exclusive Addons for Elementor plugin <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Exclusive Addons Elementor versions = 2.7.6...

Sellers can get scammed too, and Joe goes off on a rant about imposter syndrome

Welcome to this week's edition of the Threat Source newsletter. Hello again my friends! Geez, it's been a year am I right? Lemons its February you say?! Oof. Imposter syndrome. You've heard the term I'm sure, but what is it? Basically: imposter syndrome is the persistent feeling of self-doubt and...

ABB Cylon FLXeon 9.3.4 login.js Node Timing Attack Exploit

ABB Cylon FLXeon version 9.3.4 has a timing attack vulnerability in the authentication process due to an improper comparison of password hashes in login.js and uukl.js. !/usr/bin/env python3 ABB Cylon FLXeon 9.3.4 login.js Node Timing Attack Vendor: ABB Ltd. Product web page: https://www.global.a...

MGASA-2025-0059 Updated php-tcpdf packages fix security vulnerabilities

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. CVE-2024-56519 An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely. CVE-2024-56521 An issue was discovered in...