Enhanced Multiuser CSI-Based Physical Layer Authentication Based on Information Reconciliation

This paper presents a physical layer authentication PLA technique using information reconciliation in multiuser communication systems. A cost-effective solution for low-end Internet of Things networks can be provided by PLA. In this work, we develop an information reconciliation scheme using Pola...

CVE-2025-32407

CVE-2025-32407 affects Samsung Internet for Galaxy Watch, version 5.0.9 (widely deployed up to Galaxy Watch 3). The issue is improper TLS certificate validation in the browser, enabling an attacker to impersonate any visited website and potentially perform MitM attacks, with corresponding risk to...

Adobe ColdFusion Command Injection Vulnerability

Adobe ColdFusion is a Server software developed by Adobe for creating and deploying Internet applications. Adobe ColdFusion suffers from a command injection vulnerability due to the system failing to properly neutralize or filter specific elements when processing certain input. An attacker could...

kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmapipuadt When tbIPSETATTRIPTO is not present but tbIPSETATTRCIDR exists, the values of ip and ipto are slightly swapped. Therefore, the range check for ip should be done later, but...

CVE-2025-29837

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to disclose information locally...

CVE-2024-52290

LF Edge eKuiper is affected by a Stored XSS in the Connection Configuration key “Name” (confKey). A user with rights to modify the service (e.g., kuiperUser) can inject arbitrary payloads, which then execute in the browser of other users (e.g., admins) when the key is deleted. The issue is descri...

CVE-2024-52290 Stored XSS in Configuration Key Functionality

LF Edge eKuiper is a lightweight internet of things IoT data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service e.g. kuiperUser role can inject a cross-site scripting payload into Connection Configuration key Name confKey parameter. After thi...

The vulnerability of the Scripting Engine component in browsers Edge and Internet Explorer on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Scripting Engine component in Edge and Internet Explorer browsers on Windows operating systems is related to data type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted link...

An $8.4 Billion Chinese Hub for Crypto Crime Is Incorporated in Colorado

Before a crackdown by Telegram, Xinbi Guarantee grew into one of the internet’s biggest markets for Chinese-speaking crypto scammers and money laundering. And all registered to a US address...

kernel: net: inet6: do not leave a dangling sk pointer in inet6_create()

In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6create sockinitdata attaches the allocated sk pointer to the provided sock object. If inet6create fails later, the sk object is released, but the sock object retains the...

kernel: net: restrict SO_REUSEPORT to inet sockets

In the Linux kernel, the following vulnerability has been resolved: net: restrict SOREUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot 1. Trying to acquire a mutex in RCU callback is not allowed. Restrict...

kernel: ipv6: prevent UAF in ip6_send_skb()

A possible use-after-free was found in the Linux kernel in net/ipv6/ip6output.c...

kernel: icmp: change the order of rate limits

A flaw was found in the Linux kernel related to the order of rate limits for ICMP messages. The sequence in which rate limiters are applied potentially allows a side-channel attack, resulting in information disclosure...

KB5058380: Cumulative security update for Internet Explorer: May 13, 2025

None None...

Multiparty Selective Disclosure Using Attribute-Based Encryption

This study proposes a mechanism for encrypting SD-JWT Selective Disclosure JSON Web Token Disclosures using Attribute-Based Encryption ABE to enable flexible access control on the basis of the Verifier's attributes. By integrating Ciphertext-Policy ABE CP-ABE into the existing SD-JWT framework, t...

PT-2025-21001

Name of the Vulnerable Software and Affected Versions Microsoft Scripting Engine affected versions not specified Description The issue is related to a type confusion vulnerability in the Microsoft Scripting Engine, which allows an unauthorized attacker to execute code over a network. This can be...

Lightweight Hybrid Block-Stream Cryptographic Algorithm for the Internet of Things

In this thesis, a novel lightweight hybrid encryption algorithm named SEPAR is proposed, featuring a 16-bit block length and a 128-bit initialization vector. The algorithm is designed specifically for application in Internet of Things IoT technology devices. The design concept of this algorithm i...

Deepfakes, Scams, and the Age of Paranoia

As AI-driven fraud becomes increasingly common, more people feel the need to verify every interaction they have online...

KingFor KFOX 代码问题漏洞

KingFor KFOX is a domestically owned and controlled industrial-grade real-time operating system from China's KingFor Information KingFor, targeting the intelligent manufacturing and Internet of Things IoT sectors. KingFor KFOX suffers from a code issue vulnerability that originates from allowing...

MAL-2025-4219 Malicious code in free-internet-dns (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 80f5bbcb50f9c9699a083711bb4d59905b49a198ddcd8c95425030d01d6a45e5 Installing the package installs a backdoor a qsocket.io and automatically uploads access credentials from the output of the qsocket client to the remote server...