Have I Been Pwned Set to Go Open-Source

Have I Been Pwned, the service that logs data breaches and lets individuals search to see if they’ve been affected by one, is about to go open-source. The result of that, according to its founder, will be additional transparency and security-enhancing features. HIBP, which was kicked off in 2013,...

New Guide: How Akamai Helps You Protect Privacy Data

Laws and regulations related to personally identifiable information PII are continuously being enacted around the world as data breaches and abuses persist. According to the February 2020 United Nations Conference on Trade and Development, 132 out of 194 countries had legislation put in place to...

Zero Trust: From security option to business imperative overnight

Not long ago when I spoke with customers about Zero Trust, our conversations focused on discussing the principles, defining scope, or sharing our own IT organization’s journey. Zero Trust was something interesting to learn about, and most organizations were very much in the exploratory phase. As...

P2PE v3.0 – Why organizations should prepare now

The Payment Card Industry Security Standards Council PCI SSC published version 3.0 of the Point-To-Point Encryption P2PE standard back in December 2019. The new version simplifies and adds flexibility to the process for component and solution providers to validate their P2PE products for cardhold...

Skype for Business IE Unauthorized Access

The vulnerability of the Skype for Business app in Internet Explorer is related to the lack of protection for service data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by clicking on a specially created link within the app...

Skype for Business Microsoft Edge Unauthorized Access

The vulnerability in the Skype for Business app for the Microsoft Edge browser is related to the lack of protection for business-related data. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information by clicking on a specially created link...

PT-2020-3584

Name of the Vulnerable Software and Affected Versions iOS versions prior to 13.6 iPadOS versions prior to 13.6 macOS Catalina versions prior to 10.15.6 Description An issue existed in the handling of environment variables, which has been addressed with improved validation. This issue may allow a...

Guiding principles of our identity strategy: staying ahead of evolving customer needs

Last June, when I shared the 5 principles driving a customer-obsessed identity strategy at Microsoft, many of you had embraced the idea of a boundaryless environment, but relatively few had implemented it in practice. A global pandemic made remote access essential and forced many of you to...

9 Tips to Keep Your Cloud Storage Safe and Secure

Make sure that your Dropbox, Google Drive, and Microsoft OneDrive data is protected—while still being easy for you to access...

Windows Imaging Component Disclosure

The vulnerability of the Windows Imaging Component WIC framework in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially created web page or document...

GHSA-WVH7-5P38-2QFC Storing Password in Local Storage

The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...

Moxa EDR-G902 EDR-G903 Buffer Overflow

The vulnerability of the microprogramming software of Moxa EDR-G902 and EDR-G903 is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, or accessibility of the protected information...

Windows kernel Information Disclosure

The vulnerability of the Windows operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created application...

EMC Data Protection Advisor 6.4 / 6.5 / 18.1 OS Command Injection (DSA-2020-081)

The version of EMC Protection Advisor installed on the remote host is 6.4, 6.5 or 18.1. It is, therefore, affected by an OS command injection vulnerability. An authenticated, remote attacker can exploit this to execute arbitrary commands on the affected system. C Tenable Network Security, Inc...

Enterprise Data Security: It’s Time to Flip the Established Approach

There’s an old saying when it comes to big undertakings: Don’t boil the ocean. Well, there’s hardly any bigger project in information security than trying to protect corporate data. But the reality is that too many organizations today are, in fact, “boiling the ocean” when it comes to their...

Security Bulletin: IBM Java Runtime Vulnerability affects the IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments (CVE-2020-2654)

Summary A denial of service vulnerability in IBM® Runtime Environment Java™ was disclosed as part of the IBM Java SDK updates in January 2020. IBM® Runtime Environment Java™ is used by the IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum...

Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect for Virtual Environments (CVE-2020-5259, CVE-2020-5258)

Summary Dojo could allow a remote attacker to inject arbitrary code on the system which affects IBM Spectrum Protect for Virtual Environments. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a...

CVE-2020-14704

CVE-2020-14704 affects Oracle VM VirtualBox (Core). Vulnerable in: VirtualBox 5.2.x before 5.2.44, 6.0.x before 6.0.24, and 6.1.x before 6.1.12. The issue allows a high-privilege attacker with logon to compromise VirtualBox and potentially access all data within VirtualBox-usable data; attacks ma...

VM-Series Network Interface Card Information Disclosure

The vulnerability of the VM-Series network firewalls is related to insufficient protection of registration data. Exploiting this vulnerability can allow attackers to disclose protected information and cause service failures...

cockpit-ovirt Plugin Privilege Credentials Exposure

The vulnerability of the /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var component of the cockpit-ovirt plugin, a software tool for managing virtualization of servers and workstations in Red Hat Virtualization, is related to insufficient protection of registration data...