Security Bulletin: Sensitive data protection vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1349)

Summary IBM Sterling B2B Integrator Standard Edition stores potentially sensitive information from HTTP sessions that could be read by a local user. Vulnerability Details CVEID: CVE-2017-1349 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition stores potentially sensitive information from...

CVE-2019-15126 aka Kr00k

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a...

Washington Privacy Act welcomed by corporate and nonprofit actors

The steady parade of US data privacy legislation continued last month in Washington with the introduction of an improved bill that would grant state residents the rights to access, control, delete, and port their data, as well as opting out of data sales. The bill, called the Washington Privacy...

Changing the Monolith—Part 3: What’s your process?

In my 25-year journey, I have led security and privacy programs for corporations and provided professional advisory services for organizations of all types. Often, I encounter teams frantically running around in their own silos, trying to connect the dots and yet unsure if those are the right dot...

Cyber-risk assessments—the solution for companies in the Fourth Industrial Revolution

Technology continues to play a critical role in shaping the global risks landscape for individuals, governments, and businesses. According to the World Economic Forum's Global Risks Report 2020, cyberattacks are ranked as the second risk of greatest concern for business globally over the next 10...

How to Get the Most Out of Your Smartphone's Encryption

Both iPhones and Androids are encrypted by default. But there are steps you can take to safeguard your data on backups and messaging apps...

Oracle VM VirtualBox Core Disclosure

The vulnerability of the Core component in Oracle VM VirtualBox is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Oracle VM VirtualBox Core Component Data Compromise

The vulnerability of the Core component of the Oracle VM VirtualBox software relates to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Oracle FLEXCUBE Universal Banking Simulation Modeling Application Data Read/Modify

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking component, a banking analytics system for simulation-based modeling by Oracle Financial Services Applications, is related to the lack of protection for operational data. Exploiting this vulnerability...

Oracle VM VirtualBox Core Disclosure

The vulnerability of the Core component in Oracle VM VirtualBox is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Linux Kernel Unprotected Service Data Access

The vulnerability of Linux operating system kernels is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using a USB device driver drivers/net/can/usb/kvaserusb/kvaserusbleaf.c driver...

Data privacy is about more than compliance—it’s about being a good world citizen

Happy Data Privacy Day! Begun in 2007 in the European Union E.U. and adopted by the U.S. in 2008, Data Privacy Day is an international effort to encourage better protection of data and respect for privacy. It’s a timely topic given the recent enactment of the California Consumer Privacy Act CCPA...

Data Privacy Day: A Vision for the Future

January 28 is Data Privacy Day, an annual effort to empower individuals and organizations to respect privacy, safeguard data, and enable trust. This year, the National Cyber Security Alliance NCSA is bringing together experts on U.S. and international privacy for A Vision for the Future, an...

Oracle VM VirtualBox Core Disclosure

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Linux driver Can USB Disclosure

The vulnerability in the drivers/net/can/usb/peakusb/pcanusbcore.c file of the Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

SAP BusinessObjects Business Intelligence Central Management Console Unauthorized Access

The vulnerability of the Central Management Console component of the SAP BusinessObjects Business Intelligence platform is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected...

Oracle FLEXCUBE Universal Banking Infrastructure Sub-component Unauthorized Access

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system, a simulation-based application of Oracle Financial Services, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating...

Oracle VM VirtualBox Core Disclosure

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Linux driver CVE Disclosure Protected Information

The vulnerability in the driver drivers/net/can/usb/peakusb/pcanusbpro.c of the Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Geocoder gem for Ruby contains possible SQL injection vulnerability

sql.rb in Geocoder allows Boolean-based SQL injection when withinboundingbox is used in conjunction with untrusted swlat, swlng, nelat, or nelng data...