8643 matches found
Making Acoustic Side-Channel Attacks on Noisy Keyboards Viable with LLM-Assisted Spectrograms' "Typo" Correction
The large integration of microphones into devices increases the opportunities for Acoustic Side-Channel Attacks ASCAs, as these can be used to capture keystrokes' audio signals that might reveal sensitive information. However, the current State-Of-The-Art SOTA models for ASCAs, including...
Cartesian Merkle Tree
This paper introduces the Cartesian Merkle Tree, a deterministic data structure that combines the properties of a Binary Search Tree, a Heap, and a Merkle tree. The Cartesian Merkle Tree supports insertions, updates, and removals of elements in $O\log n$ time, requires $n$ space, and enables...
R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning
Vision-language models VLMs, such as CLIP, have gained significant popularity as foundation models, with numerous fine-tuning methods developed to enhance performance on downstream tasks. However, due to their inherent vulnerability and the common practice of selecting from a limited set of...
Exploring Backdoor Attack and Defense for LLM-Empowered Recommendations
The fusion of Large Language Models LLMs with recommender systems RecSys has dramatically advanced personalized recommendations and drawn extensive attention. Despite the impressive progress, the safety of LLM-based RecSys against backdoor attacks remains largely under-explored. In this paper, we...
WordPress SureTriggers All-in-One Automation Platform 1.0.78 Authentication Bypass
WordPress SureTriggers All-in-One Automation Platform plugin versions 1.0.78 and below suffer from an authentication bypass vulnerability that allows for privilege escalation...
Superintelligence Strategy: Expert Version
Rapid advances in AI are beginning to reshape national security. Destabilizing AI developments could rupture the balance of power and raise the odds of great-power conflict, while widespread proliferation of capable AI hackers and virologists would lower barriers for rogue actors to cause...
FlexiContracts: a Novel and Efficient Scheme for Upgrading Smart Contracts in Ethereum Blockchain
Blockchain technology has revolutionized contractual processes, enhancing efficiency and trust through smart contracts. Ethereum, as a pioneer in this domain, offers a platform for decentralized applications but is challenged by the immutability of smart contracts, which makes upgrades cumbersome...
Encryption Scheme Based on Automorphism Group of Hermitian Function Field with Homomorphic Encryption
This article proposes a comprehensive approach to implementing encryption schemes based on the automorphism group of the Hermitian function field. We utilize a three-parameter group with logarithmic representations outside the group's center. In this work, we enhance the Hermitian function...
Designing AI-Enabled Countermeasures to Cognitive Warfare
Foreign information operations on social media platforms pose significant risks to democratic societies. With the rise of Artificial Intelligence AI, this threat is likely to intensify, potentially overwhelming human defenders. To achieve the necessary scale and tempo to defend against these...
Investigating Cybersecurity Incidents Using Large Language Models in Latest-Generation Wireless Networks
The purpose of research: Detection of cybersecurity incidents and analysis of decision support and assessment of the effectiveness of measures to counter information security threats based on modern generative models. The methods of research: Emulation of signal propagation data in MIMO systems,...
Concept Enhancement Engineering: a Lightweight and Efficient Robust Defense against Jailbreak Attacks in Embodied AI
Embodied Intelligence EI systems integrated with large language models LLMs face significant security risks, particularly from jailbreak attacks that manipulate models into generating harmful outputs or executing unsafe physical actions. Traditional defense strategies, such as input filtering and...
Overcoming Bottlenecks in Homomorphic Encryption for the 2024 Mexican Federal Election
On June 2, 2024, Mexico held its federal elections. The majority of Mexican citizens voted in person at the polls in this historic election. For the first time though, Mexican citizens living outside their country were able to vote online via a web app, either on a personal device or using an...
Can LLMs Handle WebShell Detection? Overcoming Detection Challenges with Behavioral Function-Aware Framework
WebShell attacks, in which malicious scripts are injected into web servers, are a major cybersecurity threat. Traditional machine learning and deep learning methods are hampered by issues such as the need for extensive training data, catastrophic forgetting, and poor generalization. Recently, Lar...
The Voynich Codex Decoded: Statistical Symbolism and Scroll-Wide Logic
This paper introduces a structured decoding framework for the Voynich Manuscript, based on mathematical rhythm, symbolic transformation, and glyph-level recursion. Rather than interpret symbols phonetically, this method decodes them by structural roles and spatial pacing. Using scroll-wide...
OX App Suite Cross Site Scripting / Third Party Vulnerabilities
OX App Suite has addressed multiple cross site scripting vulnerabilities as well as third party vulnerabilities. Last affected versions include 7.10.6 with various revisions...
Research on CNN-BiLSTM Network Traffic Anomaly Detection Model Based on MindSpore
With the widespread adoption of the Internet of Things IoT and Industrial IoT IIoT technologies, network architectures have become increasingly complex, and the volume of traffic has grown substantially. This evolution poses significant challenges to traditional security mechanisms, particularly ...
Ivanti Connect Secure / Policy Secure / ZTA Gateways Remote Code Execution
Proof of concept exploit that demonstrates a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2...
WordPress Processing Projects 1.0.2 Shell Upload
WordPress Processing Projects plugin versions 1.0.2 and below suffer from a remote shell upload vulnerability...
WordPress Simple Dashboard 2.0 Privilege Escalation
WordPress Simple Dashboard plugin versions 2.0 and below suffer from an unauthenticated privilege escalation vulnerability...
The Riskiest Connected Devices of 2025
Since 2020, Forescout Research - Vedere Labs has been monitoring the riskiest devices in organizational networks, leveraging data sourced directly from the devices themselves. This marks their fifth report in six years...
Multi-Party Private Set Operations from Predicative Zero-Sharing
Typical protocols in the multi-party private set operations MPSO setting enable m 2 parties to perform certain secure computation on the intersection or union of their private sets, realizing a very limited range of MPSO functionalities. Most works in this field focus on just one or two specific...
Wapiti Web Application Vulnerability Scanner 3.2.4
Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities...
Centreon API 19.04 Bruteforcer
Centreon version 19.04 login password bruteforcing tool...
OpenSSH 10.0
OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and...
OpenSSH 10.0p1
OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and...
CrushFTP 10 / 11 Authentication Bypass
This proof of concept will exploit the authentication bypass vulnerability in CrushFTP versions 10 before 10.8.4 and 11 before 11.3.1. It will create a new user account with administrative level permissions. It requires the username of an existing user as the target and the default is set to...
FASTRPC_ATTR_KEEP_MAP Use-After-Free
A FASTRPCATTRKEEPMAP logic bug allows fastrpcinternalmunmapfd to concurrently free in-use mappings leading to a use-after-free condition...
WordPress Bricks Builder 1.9.6 Remote Code Execution
WordPress Bricks Builder plugin versions 1.9.6 and below unauthenticated remote code execution exploit...
WordPress Motors 1.4.64 Arbitrary Plugin Installation
WordPress Motors plugin versions 1.4.64 and below suffer from an arbitrary plugin installation vulnerability...
Next.js Middleware 15.2.2 Authorization Bypass
Next.js Middleware authorization bypass proof of concept exploit. Versions affected include 13.0.0 through 13.5.8, 14.0.0 through 14.2.24, 15.0.0 through 15.2.2, and 11.1.4 through 12.3...
OpenSCAP Libraries 1.3.12
The openscap project is a set of open source libraries that support the SCAP Security Content Automation Protocol set of standards from NIST. It supports CPE, CCE, CVE, CVSS, OVAL, and XCCDF...
AIDE 0.19
AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...
Firefox xslt/txNodeSorter Out-Of-Bounds Access
An inconsistent comparator in xslt/txNodeSorter leads to out-of-bounds access in Firefox...
WordPress RomethemeKit for Elementor 1.5.4 Arbitrary Plugin Installation
WordPress RomethemeKit For Elementor plugin versions 1.5.4 and below suffer from an authenticated arbitrary plugin installation and activation vulnerability that can lead to remote code execution...
Apple Security Advisory 03-31-2025-1
Apple Security Advisory 03-31-2025-1 - Safari 18.4 addresses buffer overflow, cross site scripting, spoofing, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-2
Apple Security Advisory 03-31-2025-2 - Xcode 16.3 addresses issues where a malicious app could access private information or overwrite arbitrary files...
Apple Security Advisory 03-31-2025-3
Apple Security Advisory 03-31-2025-3 - iOS 18.4 and iPadOS 18.4 addresses buffer overflow, bypass, cross site scripting, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-4
Apple Security Advisory 03-31-2025-4 - iPadOS 17.7.6 addresses buffer overflow, out of bounds read, spoofing, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-5
Apple Security Advisory 03-31-2025-5 - iOS 16.7.11 and iPadOS 16.7.11 addresses an out of bounds write vulnerability...
Apple Security Advisory 03-31-2025-6
Apple Security Advisory 03-31-2025-6 - iOS 15.8.4 and iPadOS 15.8.4 addresses an out of bounds write vulnerabilities...
Apple Security Advisory 03-31-2025-7
Apple Security Advisory 03-31-2025-7 - macOS Sequoia 15.4 addresses buffer overflow, bypass, code execution, format string, heap corruption, integer overflow, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-8
Apple Security Advisory 03-31-2025-8 - macOS Sonoma 14.7.5 addresses buffer overflow, bypass, code execution, format string, heap corruption, integer overflow, out of bounds read, out of bounds write, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-10
Apple Security Advisory 03-31-2025-10 - tvOS 18.4 addresses buffer overflow, out of bounds read, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-11
Apple Security Advisory 03-31-2025-11 - visionOS 2.4 addresses buffer overflow, bypass, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...
Apple Security Advisory 04-01-2025-1
Apple Security Advisory 04-01-2025-1 - watchOS 11.4 addresses buffer overflow, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...
Apple Security Advisory 03-31-2025-9
Apple Security Advisory 03-31-2025-9 - macOS Ventura 13.7.5 addresses buffer overflow, bypass, code execution, format string, heap corruption, integer overflow, out of bounds read, out of bounds write, and use-after-free vulnerabilities...
WordPress Front-End Users 3.2.32 Shell Upload
WordPress Front-End Users plugin versions 3.2.32 and below suffer from a remote shell upload vulnerability...
Wazuh 4.11.2
Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...
Advanced XSS Exploitation - Capturing User Local Storage Data
In this paper, the author teaches advanced persistent cross site scripting techniques that can be used to capture data from the client's local storage and send it to an external server. The paper is primarily focusing on a pentesting perspective but also discusses mitigations. Written in Brazilia...