Prompt Injection Defenses Against LLM Cyberattacks

Interesting research: "Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks": Large language models LLMs are increasingly being harnessed to automate cyberattacks, making sophisticated exploits more accessible and scalable. In response, we propose a new defens...

Enalean Tuleap 安全漏洞

Enalean Tuleap is a free and open source tool from the French company Enalean. It is used for end-to-end traceability of application and system development. A security vulnerability exists in Enalean Tuleap. An attacker exploiting the vulnerability could view tracker names that they should not ha...

DataEase 代码问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. Used to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . A code issue vulnerability exists in versions prior to DataEase v1.18.25...

UBUNTU-CVE-2024-45618

A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have...

Probate Back Office 注入漏洞

Probate Back Office is an open source tool from HM Courts & Tribunals Service. An injection vulnerability exists in Probate Back Office c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 and prior versions, which stems from an unknown function in the Markdown Handler component and could lead to an injectio...

Flowise 安全漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise version 1.8.2, which results in a denial of service due to improper handling of user-supplied input to the "/api/v1/get-upload-file" api endpoint...

VNote Security Vulnerability

VNote is an open source cross-platform Markdown note-taking tool from VNote Open Source. A security vulnerability exists in VNote versions prior to 3.18.1, which stems from the presence of a code execution vulnerability that could allow an attacker to execute arbitrary programs on the victim's...

AJ-Report SQL Injection Vulnerability (CNVD-2024-34975)

AJ-Report is a fully open source, drag-and-drop editing visualization design tool. AJ-Report version 1.4.1 suffers from a SQL injection vulnerability, which can be exploited by an attacker to send specially crafted SQL statements to the /pageList script using the 'p' parameter to view, add, modif...

AJ-Report 代码问题漏洞

AJ-Report is a fully open source, drag-and-drop editing visual design tool from anji-plus open source. A code issue vulnerability exists in anji-plus AJ-Report 1.4.1 and earlier versions, which stems from a deserialization vulnerability in the component...

Unspecified Vulnerability in DataEase (CNVD-2024-20785)

DataEase is an open source data visualization and analysis tool. Used to help users quickly analyze data and gain insight into business trends , so as to achieve business improvement and optimization . A security vulnerability exists in DataEase versions prior to 2.5.0. Attackers can use this...

OpenSC Resource Management Error Vulnerability

OpenSC is an open source smart card tool and middleware. OpenSC suffers from a resource management error vulnerability that stems from the presence of a post-release reuse vulnerability...

PYSEC-2024-126

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

...

Label Studio Security Vulnerability

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats. A security vulnerability exists in Label Studio versions prior to...

Exploit for CVE-2023-38646

CVE-2023-38646 PoC Description This is a Proof of Concept...

New OS Tool Tells You Who Has Access to What Data

Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential ...

PT-2023-25861 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.9 Description: DataEase is an open source data visualization analysis tool. It has a SQL injection vulnerability that can bypass blacklists. Recommendations: For versions prior to 1.18.9, update to version 1.18...

DataEase 安全漏洞

DataEase is an open source data visualization and analysis tool. It is used to help users quickly analyze data and gain insights into business trends for business improvement and optimization. A security vulnerability exists in DataEase versions prior to 1.18.8 that stems from a lack of...

CVE-2023-31143 Mage terminal user authentication not working properly

mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have...

Archery SQL注入漏洞

Archery is an open source vulnerability assessment and management tool. Archery suffers from a SQL injection vulnerability that stems from the inclusion of multiple SQL injection vulnerabilities that could allow an attacker to query a connected database...