8809 matches found
PT-2025-32374 · Unknown · Phone Application
Name of the Vulnerable Software and Affected Versions: Phone application affected versions not specified Description: A TLS vulnerability exists in the phone application used to manage a connected device. The application accepts self-signed certificates when establishing TLS communication,...
Dreamehome app和Dreame MOVAhome app 信任管理问题漏洞
The Dreamehome app and Dreame MOVAhome app are both mobile apps from Dreame, Inc. A trust management issue vulnerability exists in the Dreamehome app and Dreame MOVAhome app, which stems from the acceptance of self-signed certificates in TLS communication and could lead to a man-in-the-middle...
Semi-Supervised Supply Chain Fraud Detection with Unsupervised Pre-Filtering
Detecting fraud in modern supply chains is a growing challenge, driven by the complexity of global networks and the scarcity of labeled data. Traditional detection methods often struggle with class imbalance and limited supervision, reducing their effectiveness in real-world applications. This...
Driver of destruction: How a legitimate driver is being used to take down AV processes
Introduction In a recent incident response case in Brazil, we spotted intriguing new antivirus AV killer software that has been circulating in the wild since at least October 2024. This malicious artifact abuses the ThrottleStop.sys driver, delivered together with the malware, to terminate numero...
Multilingual Source Tracing of Speech Deepfakes: a First Benchmark
Recent progress in generative AI has made it increasingly easy to create natural-sounding deepfake speech from just a few seconds of audio. While these tools support helpful applications, they also raise serious concerns by making it possible to generate convincing fake speech in many languages...
Onion Site Template 信任管理问题漏洞
Onion Site Template is a self-hosted example from Vessel9817 Individual Developer. Onion Site Template suffers from a trust management issue vulnerability that stems from the inclusion of a fixed tor mirror, which could lead to a compromised website...
AWS VDP: AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs
Issue Summary A LibreChat endpoint/UI is found to be accessible to the public Internet, with self registration for any non AWS/Amazon Corporate domains enabled, allowing an attacker to use a ChatGPT like UI to access multiple public models Example : Claude with the API access it has enabled, as...
CVE-2025-54789
The CVE-2025-54789 entry relates to the Files module, specifically the File Move functionality. Versions ≤ 0.16.9 allow injection of arbitrary JavaScript, enabling Browser JavaScript execution in the user’s session. This is the underlying issue described across multiple sources (NVD, Red Hat advi...
CVE-2025-54789 Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...
CVE-2025-54789 Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...
SAEL: Leveraging Large Language Models with Adaptive Mixture-Of-Experts for Smart Contract Vulnerability Detection
With the increasing security issues in blockchain, smart contract vulnerability detection has become a research focus. Existing vulnerability detection methods have their limitations: 1 Static analysis methods struggle with complex scenarios. 2 Methods based on specialized pre-trained models...
Can We End the Cat-And-Mouse Game? Simulating Self-Evolving Phishing Attacks with LLMs and Genetic Algorithms
Anticipating emerging attack methodologies is crucial for proactive cybersecurity. Recent advances in Large Language Models LLMs have enabled the automated generation of phishing messages and accelerated research into potential attack techniques. However, predicting future threats remains...
DEBIAN-CVE-2025-38476
In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpldosrhinline. Running lwtdstcacherefloop.sh in selftest with KASAN triggers the splat below 0. rpldosrhinline fetches ipv6hdrskb and accesses it after skbcowhead, which is illegal as the header could ...
Two Views, One Truth: Spectral and Self-Supervised Features Fusion for Robust Speech Deepfake Detection
Recent advances in synthetic speech have made audio deepfakes increasingly realistic, posing significant security risks. Existing detection methods that rely on a single modality, either raw waveform embeddings or spectral based features, are vulnerable to non spoof disturbances and often overfit...
SDD: Self-Degraded Defense against Malicious Fine-Tuning
Open-source Large Language Models LLMs often employ safety alignment methods to resist harmful instructions. However, recent research shows that maliciously fine-tuning these LLMs on harmful data can easily bypass these safeguards. To counter this, we theoretically uncover why malicious fine-tuni...
CVE-2025-26397
SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication fro...
CVE-2025-51863
Self Cross Site Scripting XSS vulnerability in ChatGPT Unli ChatGPTUnli.com thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat interface...
SolarWinds Observability Self-Hosted 代码问题漏洞
SolarWinds Observability Self-Hosted is an observation platform from US-based SolarWinds. A code issue vulnerability exists in SolarWinds Observability Self-Hosted that stems from untrustworthy data deserialization, which could lead to local elevation of privilege...
rsmail
Extension: RSMail! Version: Old 1.22.26, 1.22.27, 1.22.28 / New 1.22.29 Update details: Versions affected 1.19.20 through 1.22.28. Self XSS allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted parameter. Fixed in 1.22.29 Update URL:...
