MAL-2025-24576 Malicious code in kiwi-8rq-project (npm)

The package kiwi-8rq-project was found to contain malicious code...

AI Security Map: Holistic Organization of AI Security Technologies and Impacts on Stakeholders

As the social implementation of AI has been steadily progressing, research and development related to AI security has also been increasing. However, existing studies have been limited to organizing related techniques, attacks, defenses, and risks in terms of specific domains or AI elements. Thus,...

OESA-2025-1893 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Concurrent Execution using Shar...

OESA-2025-1878 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence,...

OESA-2025-1848 git security update

Security Fixes: A vulnerability was found in Microsoft Visual Studio Programming Tool Software affected version not known. It has been classified as problematic.This is going to have an impact on confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A...

CLSA-2025-1750953703 Update of tzdata

Upgrade to tzdata-2025b - New zone for Aysén Region in Chile which moves from -04/-03 to -03. - Paraguay adopted permanent -03 starting spring 2024. - Improve pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Improve historical data for Mexico, Mongolia, and Portugal. - System V...

Malware Classification Leveraging NLP and Machine Learning for Enhanced Accuracy

This paper investigates the application of natural language processing NLP-based n-gram analysis and machine learning techniques to enhance malware classification. We explore how NLP can be used to extract and analyze textual features from malware samples through n-grams, contiguous string or API...

OS Command Exec, Unix Command Shell, Reverse SCTP (via socat)

Execute an OS command from PHP. Creates an interactive shell via socat Module Options msf use payload/php/unix/cmd/reversesocatsctp msf payloadreversesocatsctp show actions ...actions... msf payloadreversesocatsctp set ACTION msf payloadreversesocatsctp show options ...show and set options... msf...

OS Command Exec, Unix Command Shell, Bind TCP (via Ruby) IPv6

Execute an OS command from PHP. Continually listen for a connection and spawn a command shell via Ruby Module Options msf use payload/php/unix/cmd/bindrubyipv6 msf payloadbindrubyipv6 show actions ...actions... msf payloadbindrubyipv6 set ACTION msf payloadbindrubyipv6 show options ...show and se...

Security update for postgresql16

This update for postgresql16 fixes the following issues: Upgrade to 16.9: CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Changelog: https://www.postgresql.org/docs/release/16.9/ Patch Instructions: To...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250523T151856 2025-05-23T15:18:56Z jscPED-11136 GO-2025-3699 GO-2025-3690 GO-2025-3691 GO-2025-3692 GO-2025-3693 GO-2025-3694 GO-2025-3696 GO-2025-3697 GO-2025-3698 GO-2025-3699 GO-2025-3700 GO-2025-3701...

Private Geometric Median in Nearly-Linear Time

Whitepaper called Private Geometric Median In Nearly-Linear Time...

Protocol As Poetry: Case Study on Pak's Protocol Arts

Protocol art emerges at the confluence of blockchain-based smart contracts and a century-long lineage of conceptual art, participatory art, and algorithmic generative art practices. Yet existing definitions-most notably Primavera De Filippi's "protocolism"-struggle to demarcate this nascent genre...

Back to Square Roots: an Optimal Bound on the Matrix Factorization Error for Multi-Epoch Differentially Private SGD

Matrix factorization mechanisms for differentially private training have emerged as a promising approach to improve model utility under privacy constraints. In practical settings, models are typically trained over multiple epochs, requiring matrix factorizations that account for repeated...

Security update for go1.22-openssl

This update for go1.22-openssl fixes the following issues: Update to version 1.22.12 bsc1218424: Security fixes: CVE-2024-45336: net/http: sensitive headers incorrectly sent after cross-domain redirect bsc1236046 CVE-2024-45341: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints...

Configure Audit Rules for User Information Changes

Generally, for deployed services, users and user groups do not change. Passwords, however, are changed periodically but not frequently due to validity periods. It is recommended that key authentication and authorization data be audited and monitored so that changes can be traced. Performing attac...

Quantum Lifting for Invertible Permutations and Ideal Ciphers

In this work, we derive the first lifting theorems for establishing security in the quantum random permutation and ideal cipher models. These theorems relate the success probability of an arbitrary quantum adversary to that of a classical algorithm making only a small number of classical queries...

Wazuh 4.11.2

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...

PT-2025-12323

Name of the Vulnerable Software and Affected Versions NP Quote Request for WooCommerce plugin for WordPress versions up to, and including, 1.9.179 Description The issue is related to Insecure Direct Object Reference due to missing validation on a user-controlled key. This allows unauthenticated...

CVE-2024-13558: Authorization Bypass Through User-Controlled Key

The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests...