CVE-2023-53232

CVE-2023-53232 affects the Linux kernel MT7921/MT76 stack. The vulnerability arises from a kernel panic due to accessing unallocated eeprom.data, leading to a NULL dereference in mt7921_mcu_parse_response. A fix is present: the MT7921 driver no longer uses eeprom.data, and the code referencing it...

A New Platform Offers Privacy Tools to Millions of Public Servants

From data-removal services to threat monitoring, the Public Service Alliance says its new marketplace will help public servants defend themselves in an era of data brokers and political violence...

CVE-2025-0011

Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentiality...

CVE-2025-0011

CVE-2025-0011 concerns AMD Crash Defender. The issue is improper removal of sensitive information before storage or transfer, potentially revealing kernel address information and harming confidentiality. The CVE is rated CVSS v3.1 with a base score of 3.3 (LOW); attack vector LOCAL, required priv...

Linux Distros Unpatched Vulnerability : CVE-2024-9026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through...

CVE-2025-53112 GLPI's incomprehensive permission checks can lead to data removal from allowed users

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...

CVE-2025-53112 GLPI's incomprehensive permission checks can lead to data removal from allowed users

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...

CVE-2025-53112

GLPI (versions 9.1.0–10.0.18) has a permission-checking weakness that can allow unauthorized removal of specific resources. The root cause is lack of permission checks on certain deletion actions. The issue is fixed in version 10.0.19. Mitigation is to upgrade to 10.0.19 or apply vendor-provided ...

Recalling the Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacy

Machine Unlearning MU technology facilitates the removal of the influence of specific data instances from trained models on request. Despite rapid advancements in MU technology, its vulnerabilities are still under explored, posing potential risks of privacy breaches through leaks of ostensibly...

SoK: Machine Unlearning for Large Language Models

Large language model LLM unlearning has become a critical topic in machine learning, aiming to eliminate the influence of specific training data or knowledge without retraining the model from scratch. A variety of techniques have been proposed, including Gradient Ascent, model editing, and...

Certified Unlearning for Neural Networks

We address the problem of machine unlearning, where the goal is to remove the influence of specific training data from a model upon request, motivated by privacy concerns and regulatory requirements such as the "right to be forgotten." Unfortunately, existing methods rely on restrictive assumptio...

CVE-2024-10900

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmremovefileattachment function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attacker...

CVE-2024-8245 GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF

The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8245 GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF

The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2025-31225

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in spotlight search results...

CVE-2025-31220

A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious app may be able to read sensitive location information...

Apple macOS和Apple iPadOS 安全漏洞

Apple macOS and Apple iPadOS are products of Apple Inc. Apple macOS is a specialized operating system developed for Mac computers, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple macOS and Apple iPadOS that stems from insufficient removal of...

Data broker exposes 600,000 sensitive files including background checks

A researcher has discovered a data broker had stored 644,869 PDF files in a publicly accessible cloud storage container. The 713.1 GB container an Amazon S3 bucket did not have password-protection, and the data was left unencrypted, so anybody who stumbled on them could read the files. The files...

Malwarebytes Personal Data Remover: A new way to help scrub personal data online

There’s an awful lot about you online that some awful groups want to exploit. The right combination of personal data points could help an identity thief fool a bank into opening a new, fraudulent line of credit in your name. Your alma mater, salary, and email address could help an online scammer...

GHSA-2P4F-VC9Q-R5VP Typo3 Arbitrary file upload and XML External Entity processing

It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...