You won't believe you don't need to see those horrible ads on the web
Published:
This #1 trick ad companies don't want you to know!
Tool call execution through user prompt injection (CSRF) of the llama-server Web UI
Published:
A user prompt injection vulnerability (CSRF) in the llama-server (llama.cpp) Web UI (Reprompt-like) allows attackers to inject arbitrary user prompt with query parameter (?q=...), potentially leading to arbitrary shell command execution, data exfiltration, etc. (through tool calls).
User prompt injection (CSRF) on Le Chat and Grok
Published:
An user prompt injection vulnerability (CSRF) both in in the e Chat (Mistral) and Grok (Reprompt-style) allows attackers to inject user prompt with query parameter (?q=...) potentially leading data exfiltration.
Reprompt-style vulnerability in Le Chat (Mistral) and Grok.
Malleability of ECDSA (and DSA) signatures, JWTs, etc.
Published:
This blog posts explains that ECDSA and DSA signatures are malleable, that JWTs can be malleable as well and how this can be used to bypass some broken implementations of JWT deny lists (for revocation of JWTs or anti-replay protection).
Risk of reflected cross site scripting and Content-Security-Policy bypass in the WebSub intent verification
Published:
I was reading the WebSub specification (formerly PubSubHubbub) when I found that there was a risk of reflected browser-side code injection (reflected cross site scripting, reflected XSS) in the WebSub intent verification exchange.
Computer security guidelines and references
Published:
A list of computer security guidelines and references.
Authority Ambiguity Vulnerabilities in NGINX and Debian’s proxy_params
Friends don't let friends use $http_host
Published:
Two related authority-ambiguity vulnerabilities in NGINX and Debian's proxy_params configuration snippet.
Cryptography formats
Published:
If you are trying to understand the difference between the different cryptography-related formats (PKS#12, PKCS#8, PEM, X.509 certificate, DER, JWK, BEGIN ENCRYPTED PRIVATE KEY??? 🤯), you will hopefully find some useful information here (and a lot more your did not wanted to know about).
Concealing XSS payloads
Published:
PortSwigger “Concealing payloads in URL credentials” talks about concealing XSS payloads in URL credentials. The nice thing is that this makes the payload invisible to WAFs and other server-side XSS filters. You can actually conceal the payloads in other places
Testing Unicode Tag Smuggling in chatbots
Where we learn that the sky is actually a giant blueberry smoothie 🫐
Published:
Testing ASCII smuggling using Unicode Tags on LLMs/chatbots. Nothing new here. Just a short summary.
Page 1 of 5 | Previous page | Next page | JSON Feed | Atom Feed | RSS Feed