SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.
MOKOSmart MKGW1 Gateway devices with firmware version 1.1.1 do not provide an adequate session management for the administrative web interface. This allows adjacent attackers with access to the management network to read and modify the configuration of the device. Read More
On Oct 17, 2023, Bernhard Garn joined as MC member of Austria the meeting MC1 of the COST Action NERO (CA22164 – european Network on Extreme fiRe behaviOr). Copyright: MATRIS This meeting marks the start of this COST Action, which focuses… Read More
The 18th International Conference on Availability, Reliability, and Security (ARES 2023) took center stage in Benevento, Italy, from August 29 to September 1, 2023, offering a platform for experts and enthusiasts to explore the latest developments in the field. Co-located with ARES 2023 was the International IFIP Cross Domain Conference… Read More
We had the great pleasure of hosting the first policy dialogue and study visit within the Mutual Learning Exercise on Knowledge Valorisation from June 19-20, 2023 in Vienna. Over the course of two days, the participants engaged in extensive discussions on incentives and skills for research… Read More
Vtiger CRM 7.4.0 or below is prone to a stored cross-site scripting vulnerability in the email templates module due to insufficient sanitizing. Read More
sec4dev 2022 is over and wow wow wow - we are more than happy after having 4 days of great bootcamps, interesting talks and more than 170 participants, making the sec4dev Conference & Bootcamp a fantastic event!! From September 6-9, 2022 the TU Wien was turned into THE place to be for developers and everybody interested in security. Read More
The 17th International Conference on Availability, Reliability and Security (ARES 2022), was held from August 23 to August 26, 2022 in SBA Research’ home town, Vienna. Co-located with ARES for the sixth time was the International IFIP Cross Domain Conference for Machine Learning & Knowledge Extraction –… Read More
Today is Safer Internet Day! To raise awareness on the significance of how to navigate the web safely two excellent projects tackle the problem of security training and awareness from a different angle. Cyber Security Quiz Breaking down essential security topics applying the concepts of microlearning, gamification ,and… Read More
Shibboleth Identity Provider OIDC OP plugin 3.0.3 or below is prone to a server-side request forgery (SSRF) vulnerability due to an insufficient restriction of the request_uri parameter. This allows unauthenticated attackers to interact with arbitrary third-party HTTP services. We recommend to update Shibboleth Identity Provider OIDC OP plugin to version 3.0.4 or later. For further details, see the full security advisory. Read More
On November 23, 2021 our key researcher Johanna Ullrich was interviewed for the Radio Ö1 program Journal-Panorama. The topic was “Cybercrime” and the increasing importance of Cyber Security. Here is the link to the article about the program and the record which is online until November 30,… Read More
The 21th International Conference on Availability, Reliability, and Security (ARES 2026) took center stage in Linköping, Sweden, from August 24 - 27, 2026, offering a platform for experts and enthusiasts to explore the latest developments in the field. The conference was jointly organised by Linköpings universitet (LiU) and SBA Research. ∞
New paper “Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats”, was recently accepted for the 35th USENIX Security Symposium. The paper is a collaboration between SBA, the University of Vienna, and the Interdisciplinary Transformation University Austria (IT:U). It was authored by Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer. ∞
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets (CVE-2026-16969), custom attributes (CVE-2026-18360) and datastore upload (CVE-2026-18361) functions. ∞