Windows kernel Information Disclosure

The vulnerability of the Windows operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created application...

win32k Disclosure Protected Information

The vulnerability of the win32k component in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

A week in security (March 2 – 8)

Last week on Malwarebytes Labs, we fired up part 1 of our series on child identity theft, asked how well law enforcement can deal with cybercriminals, and took a trip down the memory lane of moral panic. We also looked at the positives and negatives of VPNs and examined our own progress in the...

CVE-2019-17644

CVE-2019-17644 affects Centreon versions before 2.8-30, 18.10-8, 19.04-5, and 19.10-2. An unauthenticated direct request to include/configuration/configObject/host/refreshMacroAjax.php permits disclosure of sensitive information. Root cause is improper access control on the host macro refresh end...

Intel Processor Graphics Information Disclosure

The vulnerability of microprogrammed software in Intel processors and Intel Processor Graphics is related to the lack of protection for system data. Exploiting this vulnerability can allow attackers to disclose protected information...

SAP Mobile Secure for Android Disclosure

The vulnerability of the SAP Mobile Secure for Android security tool is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to disclose the protected information...

Hybrid Cloud Changes the Game for Security

How to protect critically important data residing on server workloads across the hybrid cloud while achieving significant operational benefits...

Google Advises Android Developers to Encrypt App Data On Device

Google today published a blog post recommending mobile app developers to encrypt data that their apps generate on the users' devices, especially when they use unprotected external storage that's prone to hijacking. Moreover, considering that there are not many reference frameworks available for t...

U.S. Dept Of Defense: Sensitive Information Leaking Through DARPA Website. [█████████]

Summary: While performing recon work on websites owned by DoD i came up with DARPA website which is leaking sensitive information. Description: The above website is leaking information such as- first name and last name, email address, phone number, house address and organization name of attendees...

RSAC 2020: Blockchain is 'Garbage In', Voting Needs Paper Ballots

SAN FRANCISCO – Cryptography is at the heart of security, especially here at this week’s RSAC 2020. And during the event’s annual Cryptographer’s Panel, industry leaders broke down their top crypto-concerns, including privacy regulations, election security and blockchain. Privacy is clearly a top...

Samba LDAP Unauthorized Access

The vulnerability of the Samba network communication software component of the Active Directory LDAP server is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data...

Oracle MySQL Encryption Unauthorized Access

The vulnerability of the Server:Security:Encryption component of the Oracle MySQL database management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data...

Windows Modules Installer Service Unauthorized Access

The vulnerability of the Windows Modules Installer service in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data through a specially created application...

SAP Business One Unauthorized Access

The vulnerability of the SAP Business One resource management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

Privacy Experts Skeptical of Proposed Data Protection Agency

A new federal bureaucracy, the Data Protection Agency DPA, has been proposed to completely revamp how the U.S. government regulates data collection and misuse by big tech companies. However, while privacy experts call the agency a “good first step,” they remain skeptical about how effective it...

A US Data Protection Agency

The United States is one of the few democracies without some formal data protection agency, and we need one. Senator Gillibrand just proposed creating one...

CVE-2020-2132

CVE-2020-2132 affects Jenkins Parasoft Environment Manager Plugin 2.14 and earlier. The vulnerability stems from passwords stored unencrypted in job config.xml on the Jenkins master, allowing access by users with Extended Read permission or those with master-file access. Impact described in sourc...

How to Manage Your Privacy On and Off Facebook

Social media has come a long way in a short space of time. In a little over a decade, it’s grown from being the preserve of a relatively small group of online enthusiasts to one of the defining trends of 21st century life. As the undisputed global leader in this field, Facebook now boasts nearly...

Automated Note Search Tool Unauthorized Access

The vulnerability of the Automated Note Search Tool component of the SAP Basis system management platform is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: Sensitive data protection vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1349)

Summary IBM Sterling B2B Integrator Standard Edition stores potentially sensitive information from HTTP sessions that could be read by a local user. Vulnerability Details CVEID: CVE-2017-1349 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition stores potentially sensitive information from...