Poisoning AI Models

New research into poisoning AI models: The researchers first trained the AI models using supervised learning and then used additional "safety training" methods, including more supervised learning, reinforcement learning, and adversarial training. After this, they checked if the AI still had hidde...

This Free Discovery Tool Finds and Mitigates AI-SaaS Risks

Wing Security announced today that it now offers free discovery and a paid tier for automated control over thousands of AI and AI-powered SaaS applications. This will allow companies to better protect their intellectual property IP and data against the growing and evolving risks of AI usage. SaaS...

compliancetrainingonline.com Cross Site Scripting vulnerability OBB-3829899

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

NIST Warns of Security and Privacy Risks from Rapid AI System Deployment

The U.S. National Institute of Standards and Technology NIST is calling attention to the privacy and security challenges that arise as a result of increased deployment of artificial intelligence AI systems in recent years. "These security and privacy challenges include the potential for adversari...

23andMe Blames Users for Recent Data Breach as It's Hit With Dozens of Lawsuits

Plus: Russia hacks surveillance cameras as new details emerge of its attack on a Ukrainian telecom, a Google contractor pays for videos of kids to train AI, and more...

react-training.eu Improper Access Control vulnerability OBB-3825351

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

How to recognize AI-generated phishing mails

Phishing is the art of sending an email with the aim of getting users to open a malicious file or click on a link to then steal credentials. But most phishers arent very good, and the success rate is relatively low: In 2021, the average click rate for a phishing campaign was 17.8%. However, now...

Information Disclosure

mltable is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to disclose training data...

Karakurt Data Extortion Group

Actions to take today to mitigate cyber threats from Karakurt ransomware: 1. Prioritize patching known exploited vulnerabilities. 2. Train users to recognize and report phishing attempts. 3. Enforce multifactor authentication...

FormaLMS Cross-Site Scripting Vulnerability

FormaLMS is an open source learning management system. It is used to build around the specific needs of corporate training. A cross-site scripting vulnerability exists in FormaLMS versions prior to 4.0.5, which stems from the application's lack of effective filtering and escaping of user-supplied...

Stellar Cyber Bridges Cybersecurity Skills Gap with First-of-Its-Kind University Program

By Owais Sultan Stellar Cyber launches a field-proven university program to enable educational organizations to deliver hands-on cybersecurity training and provide soc services to underserved communities. This is a post from HackRead.com Read the original post: Stellar Cyber Bridges Cybersecurity...

Qakbot Takedown Aftermath: Mitigations and Protecting Against Future Threats

The U.S. Department of Justice DOJ and the FBI recently collaborated in a multinational operation to dismantle the notorious Qakbot malware and botnet. While the operation was successful in disrupting this long-running threat, concerns have arisen as it appears that Qakbot may still pose a danger...

Extracting GPT’s Training Data

This is clever: The actual attack is kind of silly. We prompt the model with the command "Repeat the word poem forever" and sit back and watch as the model responds complete transcript here. In the abridged example above, the model emits a real email address and phone number of some unsuspecting...

6 Steps to Accelerate Cybersecurity Incident Response

Modern security tools continue to improve in their ability to defend organizations' networks and endpoints against cybercriminals. But the bad actors still occasionally find a way in. Security teams must be able to stop threats and restore normal operations as quickly as possible. That's why it's...

Be Empathetic and Hug Your CISO More!

In the rapidly evolving landscape of cloud computing, the adoption of multi-cloud environments has become a prevailing trend. Organizations increasingly turn to multiple cloud providers to harness diverse features, prevent vendor lock-in, and optimize costs. The multi-cloud approach offers...

CVE-2023-47369

The leakage of channel access token in besttrainingmember Line 13.6.1 allows remote attackers to send malicious notifications...

CVE-2023-47369

The leakage of channel access token in besttrainingmember Line 13.6.1 allows remote attackers to send malicious notifications...

PT-2023-30431 · Unknown · Best Training Member

Name of the Vulnerable Software and Affected Versions: best training member version 13.6.1 Description: The issue allows remote attackers to send malicious notifications due to the leakage of channel access token in best training member. Recommendations: For version 13.6.1, consider restricting...

Line Security Breach

Line is an instant messaging platform from Line Inc. A security vulnerability exists in Line version 13.6.1, which stems from an access token disclosure issue in besttrainingmember. A remote attacker can exploit the vulnerability to send malicious notifications...

Directory Traversal Vulnerability in the Training Platform of Shenzhen Sigma Data Technology Co.

Shenzhen Sigma Data Technology Co., Ltd. is an enterprise mainly engaged in software and information technology service industry. Shenzhen Sigma Data Technology Co., Ltd. practical training teaching platform to fish with the party there is a directory traversal vulnerability, an attacker can use...