5024 matches found
LLMpatronous: Harnessing the Power of LLMs for Vulnerability Detection
Despite the transformative impact of Artificial Intelligence AI across various sectors, cyber security continues to rely on traditional static and dynamic analysis tools, hampered by high false positive rates and superficial code comprehension. While generative AI offers promising automation...
Growatt Cloud Applications Authorization Bypass Vulnerability (CNVD-2025-14960)
Growatt Cloud Applications is a monitoring platform from Growatt in China. An authorization bypass vulnerability exists in Growatt Cloud Applications 3.6.0 and prior versions, which can be exploited by an unauthenticated attacker to obtain a user's email by knowing the username, resulting in a...
Automating Function-Level TARA for Automotive Full-Lifecycle Security
As modern vehicles evolve into intelligent and connected systems, their growing complexity introduces significant cybersecurity risks. Threat Analysis and Risk Assessment TARA has therefore become essential for managing these risks under mandatory regulations. However, existing TARA automation...
PT-2025-17526 · Solid Plugins · Analyticswp
Name of the Vulnerable Software and Affected Versions: AnalyticsWP versions 2.1.2 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For AnalyticsWP versions 2.1....
[SECURITY] Fedora 41 Update: rust-cookie_store-0.21.1-1.fc41
Implementation of Cookie storage and retrieval...
[SECURITY] Fedora 40 Update: rust-cookie_store-0.21.1-1.fc40
Implementation of Cookie storage and retrieval...
[SECURITY] Fedora 42 Update: rust-cookie_store-0.21.1-1.fc42
Implementation of Cookie storage and retrieval...
Multi-Stage Retrieval for Operational Technology Cybersecurity Compliance Using Large Language Models: a Railway Casestudy
Operational Technology Cybersecurity OTCS continues to be a dominant challenge for critical infrastructure such as railways. As these systems become increasingly vulnerable to malicious attacks due to digitalization, effective documentation and compliance processes are essential to protect these...
SAP KMC WPC Information Disclosure Vulnerability
SAP KMC WPC is a combination of enterprise content management and web publishing components from SAP. An information disclosure vulnerability exists in SAP KMC WPC, which can be exploited by an attacker to retrieve a user name via a simple parameter query, resulting in the disclosure of sensitive...
CVE-2025-27929
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...
CVE-2025-32594
Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-3575
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...
CVE-2025-3574
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint...
PT-2025-17148 · Unknown · Hive Support
Name of the Vulnerable Software and Affected Versions: Hive Support versions 1.2.2 and earlier Description: The issue allows the retrieval of embedded sensitive data. This is due to the insertion of sensitive information into sent data, which can be exploited. Recommendations: For versions 1.2.2...
PT-2025-17130 · Wpminds · Wpminds Simple Wp Events
Name of the Vulnerable Software and Affected Versions: WPMinds Simple WP Events versions 1.8.17 and earlier Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions 1.8.17 and earlier, update...
GHSA-2J87-P623-8CC2 Mattermost vulnerable to Observable Timing Discrepancy
Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...
CVE-2025-27936
Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...
On the Feasibility of Using MultiModal LLMs to Execute AR Social Engineering Attacks
Augmented Reality AR and Multimodal Large Language Models LLMs are rapidly evolving, providing unprecedented capabilities for human-computer interaction. However, their integration introduces a new attack surface for social engineering. In this paper, we systematically investigate the feasibility...