34 matches found
CVE-2026-96580 Gitea Actions memory exhaustion through large static matrices
Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...
Risk-Analysis-Editor v3.0.0
Risk Analysis Editor RAE English · Français Standalone tool for building and visualizing risk matrices — inherent gross risk and residual net risk — with an open, documented file format, .rae.json. ▶️ Open the app · 📖 User guide · 🎬 Video tutorials · ⬇️ Download No installation: the tool runs...
ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping
Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...
On the Impact of Entropy-Based Features
Network anomaly detection is increasingly challenging due to the growing diversity and variability of traffic patterns, which are not always well captured by traditional statistical features. In this work, we explore the use of entropy as an additional feature to support supervised network traffi...
Allocation of Resources Without Limits or Throttling
Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
Allocation of Resources Without Limits or Throttling
Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
HackTheBox
HackTheBox — Writeups, Tooling & Exploitation Pipelines A wor...
Public-Key Quantum Authentication and Digital Signature Schemes Based on the QMA-Complete Problem
We propose a quantum authentication and digital signature protocol whose security is founded on the Quantum Merlin ArthurQMA-completeness of the consistency of local density matrices. The protocol functions as a true public-key cryptography system, where the public key is a set of local density...
On Key Exchange Protocol Based on Two-Side Multiplication Action
We present a cryptanalysis of a key exchange protocol based on the digital semiring. For this purpose, we find the maximal solution of a linear system over such semiring, and use the properties of circulant matrix to demonstrate that the protocol is vulnerable. Specifically, we provide an efficie...
Differentially Private Distribution Release of Gaussian Mixture Models Via KL-Divergence Minimization
Gaussian Mixture Models GMMs are widely used statistical models for representing multi-modal data distributions, with numerous applications in data mining, pattern recognition, data simulation, and machine learning. However, recent research has shown that releasing GMM parameters poses significan...
Key Exchange Protocol Based on Circulant Matrix Action over Congruence-Simple Semiring
We present a new key exchange protocol based on circulant matrices acting on matrices over a congruence-simple semiring. We describe how to compute matrices with the necessary properties for the implementation of the protocol. Additionally, we provide an analysis of its computational cost and its...
BIT-TENSORFLOW-2021-29545 Heap buffer overflow in `SparseTensorToCSRSparseMatrix`
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in converting sparse tensors to CSR Sparse matrices. This is because the...
How to Think Like a Hacker and Stay Ahead of Threats
To succeed as a cybersecurity analyst, you need to understand the traits, values, and thought processes of hackers, along with the tools they use to launch their attacks. During a webinar called The Hacker Mindset, a Red Team Researcher shared how you can use some of these tools for your own...
NumPy has an unspecified vulnerability
NumPy is a Python scientific computing package. The product supports a large number of dimensional arrays and matrices, while providing a large library of mathematical functions for data operations. numPy 1.19 has a security vulnerability that stems from a null pointer dereference vulnerability i...
Denial Of Service (DoS)
tensorflow is vulnerable to denial of service. A double redirection to access an element of an array allocated on the heap occurs when CHECK-fail in converting sparse tensors to CSR Sparse matrices in SparseTensorToCSRSparseMatrix, allowing an attacker to crash the application...
CVE-2021-29545
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in converting sparse tensors to CSR Sparse matrices. This is because the...
Out-of-bounds
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in converting sparse tensors to CSR Sparse matrices. This is because the...
PYSEC-2021-182
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in converting sparse tensors to CSR Sparse matrices. This is because the...
CVE-2021-29545
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in converting sparse tensors to CSR Sparse matrices. This is because the...
CVE-2021-29545
CVE-2021-29545 concerns TensorFlow and describes a heap-based out-of-bounds issue in SparseTensorToCSRSparseMatrix caused by a double redirection when accessing csr_row_ptr via indices(i, 0) + 1. This can lead to a denial of service by writing outside heap data. The connected OSV/GHSA entries con...