8072 matches found
WordPress RingCentral Communications 1.6.8 Authentication Bypass
WordPress RingCentral Communications plugin versions 1.5 through 1.6.8 have a missing server-side verification that allows for authentication bypass...
Campcodes Online Movie Theater Seat Reservation System 1.0 Cross Site Scripting
Campcodes Online Movie Theater Seat Reservation System version 1.0 suffers from a cross site scripting vulnerability...
M-Files 25.6.14925.0 Path Traversal
This repository contains a proof-of-concept exploit in C for a suspected path traversal vulnerability in M‑Files version 25.6.14925.0. It attempts to read sensitive files e.g. /etc/passwd by injecting traversal payloads into REST API endpoints...
MultiFuzz: a Dense Retrieval-Based Multi-Agent System for Network Protocol Fuzzing
Traditional protocol fuzzing techniques, such as those employed by AFL-based systems, often lack effectiveness due to a limited semantic understanding of complex protocol grammars and rigid seed mutation strategies. Recent works, such as ChatAFL, have integrated Large Language Models LLMs to guid...
WordPress Birth Chart Compatibility 2.0 Path Disclosure
WordPress Birth Chart Compatibility plugin versions 2.0 and below suffer from a path disclosure vulnerability...
Lantronix Provisioning Manager 7.10.3 XML Injection
Lantronix Provisioning Manager version 7.10.3 suffers from an XML injection vulnerability...
Can Multi-Modal (Reasoning) LLMs Detect Document Manipulation?
Document fraud poses a significant threat to industries reliant on secure and verifiable documentation, necessitating robust detection mechanisms. This study investigates the efficacy of state-of-the-art multi-modal large language models LLMs-including OpenAI O1, OpenAI 4o, Gemini Flash thinking,...
Explainable Ensemble Learning for Graph-Based Malware Detection
Malware detection in modern computing environments demands models that are not only accurate but also interpretable and robust to evasive techniques. Graph neural networks GNNs have shown promise in this domain by modeling rich structural dependencies in graph-based program representations such a...
Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs
Large language models LLMs demonstrate impressive capabilities in various language tasks but are susceptible to jailbreak attacks that circumvent their safety alignments. This paper introduces Latent Fusion Jailbreak LFJ, a representation-based attack that interpolates hidden states from harmful...
Semi-Supervised Supply Chain Fraud Detection with Unsupervised Pre-Filtering
Detecting fraud in modern supply chains is a growing challenge, driven by the complexity of global networks and the scarcity of labeled data. Traditional detection methods often struggle with class imbalance and limited supervision, reducing their effectiveness in real-world applications. This...
Hashcat Advanced Password Recovery 7.0.0 Binary Release
Hashcat is an advanced GPU hash cracking utility that includes the World's fastest md5crypt, phpass, mscash2 and WPA / WPA2 cracker. It also has the first and only GPGPU-based rule engine, focuses on highly iterated modern hashes, single dictionary-based attacks, and more. This is the binary...
GitKraken Desktop 11.2.1 Code Injection
GitKraken Desktop versions 10.8.0 through 11.2.1 are vulnerable to code injection via misconfigured Electron Fuses...
Understanding Concept Drift with Deprecated Permissions in Android Malware Detection
Permission analysis is a widely used method for Android malware detection. It involves examining the permissions requested by an application to access sensitive data or perform potentially malicious actions. In recent years, various machine learning ML algorithms have been applied to Android...
Hot-Swap MarkBoard: an Efficient Black-Box Watermarking Approach for Large-Scale Model Distribution
Recently, Deep Learning DL models have been increasingly deployed on end-user devices as On-Device AI, offering improved efficiency and privacy. However, this deployment trend poses more serious Intellectual Property IP risks, as models are distributed on numerous local devices, making them...
WBHT: a Generative Attention Architecture for Detecting Black Hole Anomalies in Backbone Networks
We propose the Wasserstein Black Hole Transformer WBHT framework for detecting black hole BH anomalies in communication networks. These anomalies cause packet loss without failure notifications, disrupting connectivity and leading to financial losses. WBHT combines generative modeling, sequential...
Auto-SGCR: Automated Generation of Smart Grid Cyber Range Using IEC 61850 Standard Models
Digitalization of power grids have made them increasingly susceptible to cyber-attacks in the past decade. Iterative cybersecurity testing is indispensable to counter emerging attack vectors and to ensure dependability of critical infrastructure. Furthermore, these can be used to evaluate...
Trusted Data Fusion, Multi-Agent Autonomy, Autonomous Vehicles
Multi-agent collaboration enhances situational awareness in intelligence, surveillance, and reconnaissance ISR missions. Ad hoc networks of unmanned aerial vehicles UAVs allow for real-time data sharing, but they face security challenges due to their decentralized nature, making them vulnerable t...
CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage
Model compression is crucial for minimizing memory storage and accelerating inference in deep learning DL models, including recent foundation models like large language models LLMs. Users can access different compressed model versions according to their resources and budget. However, while existi...
GATEBLEED: Exploiting On-Core Accelerator Power Gating for High Performance and Stealthy Attacks on AI
As power consumption from AI training and inference continues to increase, AI accelerators are being integrated directly into the CPU. Intel's Advanced Matrix Extensions AMX is one such example, debuting on the 4th generation Intel Xeon Scalable CPU. We discover a timing side and covert channel,...
Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Tracking
With the rise of social media, vast amounts of user-uploaded videos e.g., YouTube are utilized as training data for Visual Object Tracking VOT. However, the VOT community has largely overlooked video data-privacy issues, as many private videos have been collected and used for training commercial...
SAMEP: a Secure Protocol for Persistent Context Sharing across AI Agents
Current AI agent architectures suffer from ephemeral memory limitations, preventing effective collaboration and knowledge sharing across sessions and agent boundaries. We introduce SAMEP Secure Agent Memory Exchange Protocol, a novel framework that enables persistent, secure, and semantically...
RVISmith: Fuzzing Compilers for RVV Intrinsics
Modern processors are equipped with single instruction multiple data SIMD instructions for fine-grained data parallelism. Compiler auto-vectorization techniques that target SIMD instructions face performance limitations due to insufficient information available at compile time, requiring...
HexaMorphHash HMH - Homomorphic Hashing for Secure and Efficient Cryptographic Operations in Data Integrity Verification
In the realm of big data and cloud computing, distributed systems are tasked with proficiently managing, storing, and validating extensive datasets across numerous nodes, all while maintaining robust data integrity. Conventional hashing methods, though straightforward, encounter substan tial...
WordPress Opal Estate Pro 1.7.5 Privilege Escalation
WordPress Opal Estate Pro plugin versions 1.7.5 and below suffers from a privilege escalation vulnerability...
Consumer Beware! Exploring Data Brokers' CCPA Compliance
Data brokers collect and sell the personal information of millions of individuals, often without their knowledge or consent. The California Consumer Privacy Act CCPA grants consumers the legal right to request access to, or deletion of, their data. To facilitate these requests, California maintai...
httpx 1.7.0 Denial of Service / Out-Of-Bounds Read
httpx version 1.7.0 suffers from an out-of-bounds read in trimTitleTags due to a missing bounds check when slicing the title string...
On the Impact of Sybil-Based Attacks on Mobile Crowdsensing for Transportation
Mobile Crowd-Sensing MCS enables users with personal mobile devices PMDs to gain information on their surroundings. Users collect and contribute data on different phenomena using their PMD sensors, and the MCS system processes this data to extract valuable information for end users. Navigation...
Generative AI for Vulnerability Detection in 6G Wireless Networks: Advances, Case Study, and Future Directions
The rapid advancement of 6G wireless networks, IoT, and edge computing has significantly expanded the cyberattack surface, necessitating more intelligent and adaptive vulnerability detection mechanisms. Traditional security methods, while foundational, struggle with zero-day exploits, adversarial...
JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation
Deobfuscating JavaScript JS code poses a significant challenge in web security, particularly as obfuscation techniques are frequently used to conceal malicious activities within scripts. While Large Language Models LLMs have recently shown promise in automating the deobfuscation process,...
RepuNet: a Reputation System for Mitigating Malicious Clients in DFL
Decentralized Federated Learning DFL enables nodes to collaboratively train models without a central server, introducing new vulnerabilities since each node independently selects peers for model aggregation. Malicious nodes may exploit this autonomy by sending corrupted models model poisoning,...
Recalling the Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacy
Machine Unlearning MU technology facilitates the removal of the influence of specific data instances from trained models on request. Despite rapid advancements in MU technology, its vulnerabilities are still under explored, posing potential risks of privacy breaches through leaks of ostensibly...
Accurate BGV Parameters Selection: Accounting for Secret and Public Key Dependencies in Average-Case Analysis
The Brakerski-Gentry-Vaikuntanathan BGV scheme is one of the most significant fully homomorphic encryption FHE schemes. It belongs to a class of FHE schemes whose security is based on the presumed intractability of the Learning with Errors LWE problem and its ring variant RLWE. Such schemes deal...
On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification
What fundamentally distinguishes an adversarial attack from a misclassification due to limited model expressivity or finite data? In this work, we investigate this question in the setting of high-dimensional binary classification, where statistical effects due to limited data availability play a...
Investigating Vulnerabilities and Defenses against Audio-Visual Attacks: a Comprehensive Survey Emphasizing Multimodal Models
Multimodal large language models MLLMs, which bridge the gap between audio-visual and natural language processing, achieve state-of-the-art performance on several audio-visual tasks. Despite the superior performance of MLLMs, the scarcity of high-quality audio-visual training data and computation...
Explain First, Trust Later: LLM-Augmented Explanations for Graph-Based Crypto Anomaly Detection
The decentralized finance DeFi community has grown rapidly in recent years, pushed forward by cryptocurrency enthusiasts interested in the vast untapped potential of new markets. The surge in popularity of cryptocurrency has ushered in a new era of financial crime. Unfortunately, the novelty of t...
SoK: Advances and Open Problems in Web Tracking
Web tracking is a pervasive and opaque practice that enables personalized advertising, retargeting, and conversion tracking. Over time, it has evolved into a sophisticated and invasive ecosystem, employing increasingly complex techniques to monitor and profile users across the web. The research...
Toward a Lightweight, Scalable, and Parallel Secure Encryption Engine
The exponential growth of Internet of Things IoT applications has intensified the demand for efficient, high-throughput, and energy-efficient data processing at the edge. Conventional CPU-centric encryption methods suffer from performance bottlenecks and excessive data movement, especially in...
Understanding Content Moderation Policies and User Experiences in Generative AI Products
While recent research has focused on developing safeguards for generative AI GAI model-level content safety, little is known about how content moderation to prevent malicious content performs for end-users in real-world GAI products. To bridge this gap, we investigated content moderation policies...
Optimistic MEV in Ethereum Layer 2s: Why Blockspace Is Always in Demand
Layer 2 rollups are rapidly absorbing DeFi activity, securing over $40 billion and accounting for nearly half of Ethereum's DEX volume by Q1 2025, yet their MEV dynamics remain understudied. We address this gap by defining and quantifying optimistic MEV, a form of speculative, on-chain cyclic...
Vulnerability Disclosure or Notification? Best Practices for Reaching Stakeholders at Scale
Security researchers are interested in security vulnerabilities, but these security vulnerabilities create risks for stakeholders. Coordinated Vulnerability Disclosure has been an accepted best practice for many years in disclosing newly discovered vulnerabilities. This practice has mostly worked...
Efficient Malware Detection with Optimized Learning on High-Dimensional Features
Malware detection using machine learning requires feature extraction from binary files, as models cannot process raw binaries directly. A common approach involves using LIEF for raw feature extraction and the EMBER vectorizer to generate 2381-dimensional feature vectors. However, the high...
Mitigating Data Poisoning Attacks to Local Differential Privacy
The distributed nature of local differential privacy LDP invites data poisoning attacks and poses unforeseen threats to the underlying LDP-supported applications. In this paper, we propose a comprehensive mitigation framework for popular frequency estimation, which contains a suite of novel...
Computational Attestations of Polynomial Integrity Towards Verifiable Machine-Learning
Machine-learning systems continue to advance at a rapid pace, demonstrating remarkable utility in various fields and disciplines. As these systems continue to grow in size and complexity, a nascent industry is emerging which aims to bring machine-learning-as-a-service MLaaS to market. Outsourcing...
Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs
In Large Language Models, Retrieval-Augmented Generation RAG systems can significantly enhance the performance of large language models by integrating external knowledge. However, RAG also introduces new security risks. Existing research focuses mainly on how poisoning attacks in RAG systems affe...
Navigating Cookie Consent Violations across the Globe
Online services provide users with cookie banners to accept/reject the cookies placed on their web browsers. Despite the increased adoption of cookie banners, little has been done to ensure that cookie consent is compliant with privacy laws around the globe. Prior studies have found that cookies...
Secure Data Access in Cloud Environments Using Quantum Cryptography
Cloud computing has made storing and accessing data easier but keeping it secure is a big challenge nowadays. Traditional methods of ensuring data may not be strong enough in the future when powerful quantum computers become available. To solve this problem, this study uses quantum cryptography t...
Network Threat Detection: Addressing Class Imbalanced Data with Deep Forest
With the rapid expansion of Internet of Things IoT networks, detecting malicious traffic in real-time has become a critical cybersecurity challenge. This research addresses the detection challenges by presenting a comprehensive empirical analysis of machine learning techniques for malware detecti...
PoSyn: Secure Power Side-Channel Aware Synthesis
Power Side-Channel PSC attacks exploit power consumption patterns to extract sensitive information, posing risks to cryptographic operations crucial for secure systems. Traditional countermeasures, such as masking, face challenges including complex integration during synthesis, substantial area...
From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignment
Safely aligning large language models LLMs often demands extensive human-labeled preference data, a process that's both costly and time-consuming. While synthetic data offers a promising alternative, current methods frequently rely on complex iterative prompting or auxiliary models. To address...